diff --git a/.version_history b/.version_history
index afbb225..3f19c35 100644
--- a/.version_history
+++ b/.version_history
@@ -23,3 +23,4 @@ a670de0f,d271b84,refactor/extract-health-routes-and-server-core,2025-09-05T17:25
 a670de0f,25a709e,feature/pid-file-service-management,2025-09-05T20:30:13Z,michael,git,lua-api
 a670de0f,59f372f,feature/pid-file-service-management,2025-09-07T14:58:01Z,michael,git,lua-api
 a670de0f,683d6e5,fix/validate-config-posix-regex,2025-09-07T16:00:48Z,michael,git,lua-api
+a670de0f,24bd94d,feature/systemd-hardening,2025-09-07T16:40:47Z,michael,git,lua-api
diff --git a/deployment/linux/furt.service b/deployment/linux/furt.service
index a504d30..5dd1150 100644
--- a/deployment/linux/furt.service
+++ b/deployment/linux/furt.service
@@ -1,5 +1,5 @@
 [Unit]
-Description=furt Multi-Tenant API Gateway
+Description=furt Multi-Tenant API Gateway (Security-Hardened)
 After=network.target
 
 [Service]
@@ -14,6 +14,20 @@ RestartSec=5
 StandardOutput=journal
 StandardError=journal
 
+# === SECURITY HARDENING ===
+
+# Filesystem Protection
+ProtectSystem=strict
+ReadWritePaths=/var/run/furt /var/log/furt
+ProtectHome=yes
+
+# Process Hardening
+NoNewPrivileges=yes
+PrivateTmp=yes
+
+# Network Restriction
+RestrictAddressFamilies=AF_INET
+
 [Install]
 WantedBy=multi-user.target