diff --git a/www-apps/beszel-hub/files/beszel-hub.service b/www-apps/beszel-hub/files/beszel-hub.service
index 5a1d070..d6d4121 100644
--- a/www-apps/beszel-hub/files/beszel-hub.service
+++ b/www-apps/beszel-hub/files/beszel-hub.service
@@ -16,12 +16,12 @@ Group=beszel
 # Security/sandboxing settings
 KeyringMode=private
 LockPersonality=yes
-NoNewPrivileges=yes
+NoNewPrivileges=no
 ProtectClock=yes
 ProtectHome=read-only
 ProtectHostname=yes
 ProtectKernelLogs=yes
-ProtectSystem=strict
+ProtectSystem=full
 RemoveIPC=yes
 RestrictSUIDSGID=true
 ReadWritePaths=/var/lib/beszel-hub