diff --git a/system.rico/security.nix b/system.rico/security.nix
index dd5eadb..ee815ef 100644
--- a/system.rico/security.nix
+++ b/system.rico/security.nix
@@ -1,3 +1,15 @@
 { ... }: {
-  security.sudo.wheelNeedsPassword = false;
+  security = {
+    apparmor = {
+      enable = true;
+      enableCache = true;
+    };
+    audit.enable = true;
+    auditd.enable = true;
+    sudo = {
+      wheelNeedsPassword = false;
+    };
+    polkit.enable = true;
+    rtkit.enable = true;
+  };
 }