diff --git a/stable/nfs-client-provisioner/Chart.yaml b/stable/nfs-client-provisioner/Chart.yaml
index 6259d88e61..8bb5c05620 100644
--- a/stable/nfs-client-provisioner/Chart.yaml
+++ b/stable/nfs-client-provisioner/Chart.yaml
@@ -3,7 +3,7 @@ appVersion: 3.1.0
 description: nfs-client is an automatic provisioner that used your *already configured* NFS server, automatically creating Persistent Volumes.
 name: nfs-client-provisioner
 home: https://github.com/kubernetes-incubator/external-storage/tree/master/nfs-client
-version: 1.2.3
+version: 1.2.4
 sources:
 - https://github.com/kubernetes-incubator/external-storage/tree/master/nfs-client
 maintainers:
diff --git a/stable/nfs-client-provisioner/templates/clusterrole.yaml b/stable/nfs-client-provisioner/templates/clusterrole.yaml
index fa43e0d42b..cf4cb872ce 100644
--- a/stable/nfs-client-provisioner/templates/clusterrole.yaml
+++ b/stable/nfs-client-provisioner/templates/clusterrole.yaml
@@ -21,10 +21,4 @@ rules:
   - apiGroups: [""]
     resources: ["events"]
     verbs: ["create", "update", "patch"]
-{{- if .Values.podSecurityPolicy.enabled }}
-  - apiGroups:      ['extensions']
-    resources:      ['podsecuritypolicies']
-    verbs:          ['use']
-    resourceNames:  [{{ template "nfs-client-provisioner.fullname" . }}]
-{{- end }}
 {{- end }}
diff --git a/stable/nfs-client-provisioner/templates/deployment.yaml b/stable/nfs-client-provisioner/templates/deployment.yaml
index 7fc8113996..16c36207ad 100644
--- a/stable/nfs-client-provisioner/templates/deployment.yaml
+++ b/stable/nfs-client-provisioner/templates/deployment.yaml
@@ -34,6 +34,9 @@ spec:
       affinity:
 {{ toYaml .Values.affinity | indent 8 }}
       {{- end }}
+      securityContext:
+        runAsUser: 65534
+        fsGroup: 65534
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
diff --git a/stable/nfs-client-provisioner/templates/podsecuritypolicy.yaml b/stable/nfs-client-provisioner/templates/podsecuritypolicy.yaml
deleted file mode 100644
index 290fbcd72c..0000000000
--- a/stable/nfs-client-provisioner/templates/podsecuritypolicy.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
-{{- if .Values.podSecurityPolicy.enabled }}
-apiVersion: extensions/v1beta1
-kind: PodSecurityPolicy
-metadata:
-  name: {{ template "nfs-client-provisioner.fullname" . }}
-  labels:
-    app: {{ template "nfs-client-provisioner.name" . }}
-    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
-    heritage: {{ .Release.Service }}
-    release: {{ .Release.Name }}
-spec:
-  privileged: false
-  allowPrivilegeEscalation: false
-  requiredDropCapabilities:
-    - ALL
-  volumes:
-    - 'secret'
-    - 'nfs'
-  hostNetwork: false
-  hostIPC: false
-  hostPID: false
-  runAsUser:
-    rule: 'RunAsAny'
-  seLinux:
-    rule: 'RunAsAny'
-  supplementalGroups:
-    rule: 'RunAsAny'
-  fsGroup:
-    rule: 'RunAsAny'
-  readOnlyRootFilesystem: false
-{{- end }}
diff --git a/stable/nfs-client-provisioner/templates/role.yaml b/stable/nfs-client-provisioner/templates/role.yaml
index 0cccdcbd5e..46dd984b7a 100644
--- a/stable/nfs-client-provisioner/templates/role.yaml
+++ b/stable/nfs-client-provisioner/templates/role.yaml
@@ -12,10 +12,4 @@ rules:
   - apiGroups: [""]
     resources: ["endpoints"]
     verbs: ["get", "list", "watch", "create", "update", "patch"]
-{{- if .Values.podSecurityPolicy.enabled }}
-  - apiGroups:      ['extensions']
-    resources:      ['podsecuritypolicies']
-    verbs:          ['use']
-    resourceNames:  [{{ template "nfs-client-provisioner.fullname" . }}]
-{{- end }}
 {{- end }}
diff --git a/stable/nfs-client-provisioner/values.yaml b/stable/nfs-client-provisioner/values.yaml
index dac4ea6e5d..3312118442 100644
--- a/stable/nfs-client-provisioner/values.yaml
+++ b/stable/nfs-client-provisioner/values.yaml
@@ -44,11 +44,6 @@ rbac:
   # Specifies whether RBAC resources should be created
   create: true
 
-# If true, create & use Pod Security Policy resources
-# https://kubernetes.io/docs/concepts/policy/pod-security-policy/
-podSecurityPolicy:
-  enabled: false
-
 serviceAccount:
   # Specifies whether a ServiceAccount should be created
   create: true