diff --git a/plinth/modules/upgrades/data/lib/systemd/system/freedombox-setup-repositories.service b/plinth/modules/upgrades/data/lib/systemd/system/freedombox-setup-repositories.service
index dfb20a3a7..512b718d4 100644
--- a/plinth/modules/upgrades/data/lib/systemd/system/freedombox-setup-repositories.service
+++ b/plinth/modules/upgrades/data/lib/systemd/system/freedombox-setup-repositories.service
@@ -21,3 +21,15 @@ Description=FreedomBox: Setup software repositories
 [Service]
 ExecStart=/usr/share/plinth/actions/upgrades setup-repositories
 Type=oneshot
+LockPersonality=yes
+PrivateDevices=yes
+PrivateTmp=yes
+PrivateUsers=yes
+ProtectControlGroups=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectSystem=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+RestrictRealtime=yes
+SystemCallArchitectures=native