diff --git a/packaging/systemd/headscale.service b/packaging/systemd/headscale.service
index 7f02c915..6881b290 100644
--- a/packaging/systemd/headscale.service
+++ b/packaging/systemd/headscale.service
@@ -16,7 +16,9 @@ ReadWritePaths=/var/lib/headscale
 
 AmbientCapabilities=CAP_NET_BIND_SERVICE
 CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+DevicePolicy=closed
 LockPersonality=true
+MemoryDenyWriteExecute=true
 NoNewPrivileges=true
 PrivateDevices=true
 PrivateMounts=true