diff --git a/src/daemon/systemd/user/pipewire-pulse.service.in b/src/daemon/systemd/user/pipewire-pulse.service.in
index 252716170..fb3e2d508 100644
--- a/src/daemon/systemd/user/pipewire-pulse.service.in
+++ b/src/daemon/systemd/user/pipewire-pulse.service.in
@@ -17,9 +17,16 @@ Requires=pipewire-pulse.socket
 ConditionUser=!root
 
 [Service]
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
+RestrictNamespaces=yes
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
 Type=simple
 ExecStart=@PW_PULSE_BINARY@
 Restart=on-failure
+Slice=session.slice
 
 [Install]
 Also=pipewire-pulse.socket
diff --git a/src/daemon/systemd/user/pipewire.service.in b/src/daemon/systemd/user/pipewire.service.in
index 71cfc262d..2303418b1 100644
--- a/src/daemon/systemd/user/pipewire.service.in
+++ b/src/daemon/systemd/user/pipewire.service.in
@@ -16,9 +16,16 @@ Description=Multimedia Service
 Requires=pipewire.socket
 
 [Service]
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
+RestrictNamespaces=yes
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
 Type=simple
 ExecStart=@PW_BINARY@
 Restart=on-failure
+Slice=session.slice
 
 [Install]
 Also=pipewire.socket