diff --git a/scripts/pulse-sensor-proxy.service b/scripts/pulse-sensor-proxy.service
index 7452614..584bd05 100644
--- a/scripts/pulse-sensor-proxy.service
+++ b/scripts/pulse-sensor-proxy.service
@@ -42,6 +42,13 @@ AmbientCapabilities=
 KeyringMode=private
 LimitNOFILE=1024
 
+# Additional hardening (post-audit)
+MemoryDenyWriteExecute=true
+RestrictRealtime=true
+ProtectHostname=true
+ProtectKernelLogs=true
+SystemCallArchitectures=native
+
 # Logging
 StandardOutput=journal
 StandardError=journal