diff --git a/units/systemd-report-basic.socket b/units/systemd-report-basic.socket
index bce9309196..bfa4ea7256 100644
--- a/units/systemd-report-basic.socket
+++ b/units/systemd-report-basic.socket
@@ -16,6 +16,7 @@ ListenStream=/run/systemd/report/io.systemd.Basic
 FileDescriptorName=varlink
 SocketMode=0666
 Accept=yes
+MaxConnectionsPerSource=16
 RemoveOnStop=yes
 
 [Install]
diff --git a/units/systemd-report-basic@.service.in b/units/systemd-report-basic@.service.in
index ad4e3fce70..a8a3b76e86 100644
--- a/units/systemd-report-basic@.service.in
+++ b/units/systemd-report-basic@.service.in
@@ -10,4 +10,28 @@
 Description=Report System Basic Facts
 
 [Service]
+CapabilityBoundingSet=
+DeviceAllow=
+DynamicUser=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+PrivateDevices=yes
+PrivateIPC=yes
+PrivateNetwork=yes
+PrivateTmp=disconnected
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectHostname=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectSystem=strict
+RestrictAddressFamilies=AF_UNIX
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+SystemCallArchitectures=native
+SystemCallErrorNumber=EPERM
+SystemCallFilter=@system-service
+
 ExecStart={{LIBEXECDIR}}/systemd-report-basic