diff --git a/src/daemon/systemd/system/pipewire.service.in b/src/daemon/systemd/system/pipewire.service.in
index 543dc7a60..5bdb2c77d 100644
--- a/src/daemon/systemd/system/pipewire.service.in
+++ b/src/daemon/systemd/system/pipewire.service.in
@@ -15,6 +15,12 @@ Description=Multimedia Service
 Requires=pipewire.socket
 
 [Service]
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
+RestrictNamespaces=yes
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
 Type=simple
 ExecStart=@PW_BINARY@
 Restart=on-failure