diff --git a/install/kjv-api.service b/install/kjv-api.service
index 7ef7c91..1c9f3ec 100644
--- a/install/kjv-api.service
+++ b/install/kjv-api.service
@@ -7,6 +7,12 @@ ExecStart=/opt/kjv-api/kjv-api.sh
 User=kjv
 EnvironmentFile=/etc/environment
 KillMode=mixed
+# Hardening: the app may only write to its databases and logs, never its own code
+NoNewPrivileges=yes
+ProtectSystem=strict
+ReadWritePaths=/opt/kjv-api/data /opt/kjv-api/logs
+ProtectHome=yes
+PrivateTmp=yes
 
 [Install]
 WantedBy=multi-user.target