diff --git a/servers/legion/k8s/neuron-technologies/prod/ingress.yaml b/servers/legion/k8s/neuron-technologies/prod/ingress.yaml
index 63a50cd..4d8d506 100644
--- a/servers/legion/k8s/neuron-technologies/prod/ingress.yaml
+++ b/servers/legion/k8s/neuron-technologies/prod/ingress.yaml
@@ -13,8 +13,9 @@ spec:
       hosts:
         - neurontechnologies.ai
         - www.neurontechnologies.ai
+        - neuron.neurontechnologies.ai
   rules:
-    - host: neurontechnologies.ai
+    - host: neuron.neurontechnologies.ai
       http:
         paths:
           - path: /mcp
@@ -66,6 +67,9 @@ spec:
                 name: neuron-mcp
                 port:
                   number: 8080
+    - host: neurontechnologies.ai
+      http:
+        paths:
           - path: /license
             pathType: Prefix
             backend:
diff --git a/servers/legion/k8s/neuron-technologies/prod/mcp-deployment.yaml b/servers/legion/k8s/neuron-technologies/prod/mcp-deployment.yaml
index 05769ef..afe3760 100644
--- a/servers/legion/k8s/neuron-technologies/prod/mcp-deployment.yaml
+++ b/servers/legion/k8s/neuron-technologies/prod/mcp-deployment.yaml
@@ -21,12 +21,11 @@ spec:
         app: neuron-mcp
         slot: blue
         env: prod
-      annotations:
-        kubectl.kubernetes.io/restartedAt: "2026-04-25T08:40:00Z"
     spec:
       terminationGracePeriodSeconds: 30
       securityContext:
         runAsNonRoot: true
+        runAsUser: 1000
         seccompProfile:
           type: RuntimeDefault
       containers:
@@ -40,6 +39,7 @@ spec:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: false  # JVM writes temp files; restrict paths via allowedPaths once profiled
             runAsNonRoot: true
+            runAsUser: 1000
             capabilities:
               drop: ["ALL"]
           env: