diff --git a/images/sd-image-aarch64.nix b/images/sd-image-aarch64.nix
index 0554c91..47e1563 100644
--- a/images/sd-image-aarch64.nix
+++ b/images/sd-image-aarch64.nix
@@ -37,7 +37,10 @@ in
 
   security.sudo.wheelNeedsPassword = false;
 
-  services.openssh.enable = true;
+  services.openssh = {
+    enable = true;
+    harden = true;
+  };
 
   # sdImage.postBuildCommands =
   #   let