diff --git a/androidx-release-watcher.service b/androidx-release-watcher.service
index 50110b1..69aebb6 100644
--- a/androidx-release-watcher.service
+++ b/androidx-release-watcher.service
@@ -6,5 +6,17 @@ Wants=release-watcher-recent.timer
 WorkingDirectory=/home/bot/androidx-release-watcher
 ExecStart=/home/bot/androidx-release-watcher/venv/bin/python telegram_notifier.py
 
+; Use graceful shutdown with a reasonable timeout
+KillMode=mixed
+KillSignal=SIGQUIT
+TimeoutStopSec=5s
+
+; Use private /tmp and /var/tmp, which are discarded after the process stops.
+PrivateTmp=true
+; Use a minimal /dev (May bring additional security if switched to 'true', but it may not work on Raspberry Pi's or other devices, so it has been disabled in this dist.)
+PrivateDevices=false
+; Make /usr, /boot, /etc and possibly some more folders read-only.
+ProtectSystem=full
+
 [Install]
 WantedBy=multi-user.target