diff --git a/README.md b/README.md
index 88959c5..08d7003 100644
--- a/README.md
+++ b/README.md
@@ -36,7 +36,8 @@ Each line points at the package that implements it.
 
 Requirements: Go 1.27 (the `go` directive in `go.mod`), Node 22 for the console
 build, and a privileged port (53/443/853) or `CAP_NET_BIND_SERVICE` for the
-default listener set.
+default listener set. Listener addresses are configurable; high ports can be
+used when the process should not need that capability.
 
 ```sh
 git clone <this repository> fancy-dns && cd fancy-dns
diff --git a/deploy/k8s/00-config.yaml b/deploy/k8s/00-config.yaml
index fe6de12..411151e 100644
--- a/deploy/k8s/00-config.yaml
+++ b/deploy/k8s/00-config.yaml
@@ -21,17 +21,19 @@ data:
         list_fetch: 60s
 
     dns:
-      udp: ["0.0.0.0:53", "[::]:53"]
-      tcp: ["0.0.0.0:53", "[::]:53"]
+      # Use high ports in the pod so the container needs no privileged-port
+      # capability. Services expose the standard DNS ports to clients.
+      udp: ["0.0.0.0:1053", "[::]:1053"]
+      tcp: ["0.0.0.0:1053", "[::]:1053"]
       max_udp_size: 1232
       dot:
         enabled: true
-        listen: ["0.0.0.0:853"]
+        listen: ["0.0.0.0:1853"]
         cert_file: /etc/fancy-dns/tls/tls.crt
         key_file: /etc/fancy-dns/tls/tls.key
       doh:
         enabled: true
-        listen: ["0.0.0.0:443"]
+        listen: ["0.0.0.0:8443"]
         cert_file: /etc/fancy-dns/tls/tls.crt
         key_file: /etc/fancy-dns/tls/tls.key
         base_path: /dns-query
diff --git a/deploy/k8s/10-deployment.yaml b/deploy/k8s/10-deployment.yaml
index 10ce422..02da083 100644
--- a/deploy/k8s/10-deployment.yaml
+++ b/deploy/k8s/10-deployment.yaml
@@ -75,16 +75,16 @@ spec:
                   key: api-key
           ports:
             - name: dns-udp
-              containerPort: 53
+              containerPort: 1053
               protocol: UDP
             - name: dns-tcp
-              containerPort: 53
+              containerPort: 1053
               protocol: TCP
             - name: dot
-              containerPort: 853
+              containerPort: 1853
               protocol: TCP
             - name: doh
-              containerPort: 443
+              containerPort: 8443
               protocol: TCP
             - name: admin
               containerPort: 8080
@@ -94,10 +94,6 @@ spec:
             readOnlyRootFilesystem: true
             capabilities:
               drop: ["ALL"]
-              # Only because of the low ports. The pod is not privileged and
-              # has no other capability left; drop the Service and the
-              # Capability together if you move the listeners off 53/443.
-              add: ["NET_BIND_SERVICE"]
           # Liveness: the process is up. /api/healthz is unauthenticated on
           # purpose, because a probe cannot carry an API key.
           livenessProbe: