diff --git a/cluster/platform/cilium-config/values.yaml b/cluster/platform/cilium-config/values.yaml
index b150ac4..302a338 100644
--- a/cluster/platform/cilium-config/values.yaml
+++ b/cluster/platform/cilium-config/values.yaml
@@ -60,3 +60,24 @@ prometheus:
 # Without this the apply-sysctl-overwrites init container fails on Talos
 sysctlfix:
   enabled: false
+
+# Talos security compatibility
+# Talos restricts Linux capabilities — these settings align Cilium with Talos constraints
+securityContext:
+  capabilities:
+    ciliumAgent:
+      - CHOWN
+      - KILL
+      - NET_ADMIN
+      - NET_RAW
+      - IPC_LOCK
+      - SYS_ADMIN
+      - SYS_RESOURCE
+      - DAC_OVERRIDE
+      - FOWNER
+      - SETGID
+      - SETUID
+    cleanCiliumState:
+      - NET_ADMIN
+      - SYS_ADMIN
+      - SYS_RESOURCE