diff --git a/php/containers.json b/php/containers.json
index 08d81047..a63f5d16 100644
--- a/php/containers.json
+++ b/php/containers.json
@@ -418,7 +418,7 @@
         "CHOWN"
       ],
       "cap_drop": [
-        "ALL"
+        "NET_RAW"
       ]
     },
     {
diff --git a/php/src/Container/Container.php b/php/src/Container/Container.php
index 5a357783..6b6c5af9 100644
--- a/php/src/Container/Container.php
+++ b/php/src/Container/Container.php
@@ -27,8 +27,6 @@ readonly class Container {
         public bool                          $enableNvidiaGpu,
         /** @var string[] */
         public array                         $capAdd,
-        /** @var string[] */
-        public array                         $capDrop,
         public int                           $shmSize,
         public bool                          $apparmorUnconfined,
         /** @var string[] */
diff --git a/php/src/ContainerDefinitionFetcher.php b/php/src/ContainerDefinitionFetcher.php
index 32b35bc7..44ab329e 100644
--- a/php/src/ContainerDefinitionFetcher.php
+++ b/php/src/ContainerDefinitionFetcher.php
@@ -308,11 +308,6 @@ readonly class ContainerDefinitionFetcher {
                 $capAdd = $entry['cap_add'];
             }
 
-            $capDrop = [];
-            if (isset($entry['cap_drop'])) {
-                $capDrop = $entry['cap_drop'];
-            }
-
             $shmSize = -1;
             if (isset($entry['shm_size'])) {
                 $shmSize = $entry['shm_size'];
@@ -375,7 +370,6 @@ readonly class ContainerDefinitionFetcher {
                 $devices,
                 $enableNvidiaGpu,
                 $capAdd,
-                $capDrop,
                 $shmSize,
                 $apparmorUnconfined,
                 $backupVolumes,
diff --git a/php/src/Docker/DockerActionManager.php b/php/src/Docker/DockerActionManager.php
index 686288e0..539f01db 100644
--- a/php/src/Docker/DockerActionManager.php
+++ b/php/src/Docker/DockerActionManager.php
@@ -401,11 +401,8 @@ readonly class DockerActionManager {
             $requestBody['HostConfig']['CapAdd'] = $capAdds;
         }
 
-        $capDrops = $container->capDrop;
-        if (count($capDrops) > 0) {
-            $requestBody['HostConfig']['CapDrop'] = $capDrops;
-        } else if (!in_array('NET_RAW', $capAdds, true)) {
-            // Prevent ARP spoofing by default
+        // Disable arp spoofing
+        if (!in_array('NET_RAW', $capAdds, true)) {
             $requestBody['HostConfig']['CapDrop'] = ['NET_RAW'];
         }
 
@@ -466,11 +463,9 @@ readonly class DockerActionManager {
         // Special things for the collabora container which should not be exposed in the containers.json
         } elseif ($container->identifier === 'nextcloud-aio-collabora') {
             if (!$this->configurationManager->collaboraSeccompDisabled) {
-                // Load reference seccomp profile for collabora...
+                // Load reference seccomp profile for collabora
                 $seccompProfile = (string)file_get_contents(DataConst::GetCollaboraSeccompProfilePath());
                 $requestBody['HostConfig']['SecurityOpt'] = ["label:disable", "seccomp=$seccompProfile"];
-                // ...which allows the collabora container to run without any capabilities
-                $requestBody['HostConfig']['CapAdd'] = [];
             }
 
             // Additional Collabora options