diff --git a/units/systemd-tpm2-swtpm.service.in b/units/systemd-tpm2-swtpm.service.in
index 5ca946248c..e9127f34c9 100644
--- a/units/systemd-tpm2-swtpm.service.in
+++ b/units/systemd-tpm2-swtpm.service.in
@@ -18,10 +18,32 @@ After=modprobe@tpm_vtpm_proxy.service
 Before=tpm2.target sysinit.target shutdown.target
 
 [Service]
-Type=notify
-RuntimeDirectory=systemd/swtpm
+CapabilityBoundingSet=CAP_SYS_ADMIN
 ExecStart={{LIBEXECDIR}}/systemd-tpm2-swtpm
 # Write out volatile state (so that we can read it back after the initrd transition
 ExecStop=swtpm_ioctl --unix %t/systemd/swtpm/socket -v
 # Initiate graceful shutdown
 ExecStop=swtpm_ioctl --unix %t/systemd/swtpm/socket -s
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
+PrivateNetwork=yes
+PrivateTmp=disconnected
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectHostname=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectProc=invisible
+RestrictAddressFamilies=AF_UNIX AF_NETLINK
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+RuntimeDirectory=systemd/swtpm
+RuntimeDirectoryMode=0700
+SystemCallArchitectures=native
+SystemCallErrorNumber=EPERM
+SystemCallFilter=@system-service
+Type=notify
+UMask=0077