diff --git a/modules/services/syncthing.nix b/modules/services/syncthing.nix
index e63f3707e..c9def213d 100644
--- a/modules/services/syncthing.nix
+++ b/modules/services/syncthing.nix
@@ -61,6 +61,8 @@ with lib;
             Restart = "on-failure";
             SuccessExitStatus = [ 3 4 ];
             RestartForceExitStatus = [ 3 4 ];
+            NoNewPrivileges = true;
+            PrivateUsers = true;
           };
 
           Install = { WantedBy = [ "default.target" ]; };