diff --git a/plinth/modules/samba/data/usr/lib/systemd/system/nmbd.service.d/freedombox.conf b/plinth/modules/samba/data/usr/lib/systemd/system/nmbd.service.d/freedombox.conf
new file mode 100644
index 000000000..c178ad6a1
--- /dev/null
+++ b/plinth/modules/samba/data/usr/lib/systemd/system/nmbd.service.d/freedombox.conf
@@ -0,0 +1,16 @@
+[Service]
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
+PrivateDevices=yes
+PrivateMounts=yes
+PrivateTmp=yes
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectSystem=full
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+RestrictRealtime=yes
+SystemCallArchitectures=native
diff --git a/plinth/modules/samba/data/usr/lib/systemd/system/smbd.service.d/freedombox.conf b/plinth/modules/samba/data/usr/lib/systemd/system/smbd.service.d/freedombox.conf
new file mode 100644
index 000000000..6fc272456
--- /dev/null
+++ b/plinth/modules/samba/data/usr/lib/systemd/system/smbd.service.d/freedombox.conf
@@ -0,0 +1,15 @@
+[Service]
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
+PrivateDevices=yes
+PrivateMounts=yes
+PrivateTmp=yes
+ProtectControlGroups=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectSystem=full
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+RestrictRealtime=yes
+SystemCallArchitectures=native