diff --git a/kubernetes/audit-policy.yaml b/kubernetes/audit-policy.yaml
new file mode 100644
index 0000000..dff775c
--- /dev/null
+++ b/kubernetes/audit-policy.yaml
@@ -0,0 +1,29 @@
+apiVersion: audit.k8s.io/v1
+kind: Policy
+rules:
+  # Don't log requests to the following API endpoints
+  - level: None
+    nonResourceURLs:
+      - "/healthz*"
+      - "/version"
+      - "/swagger*"
+      - "/openapi*"
+  # Don't log authenticated requests to certain non-resource URL paths
+  - level: None
+    userGroups: ["system:authenticated"]
+    nonResourceURLs:
+      - "/api*"
+  # Log pod changes at RequestResponse level
+  - level: RequestResponse
+    resources:
+      - group: ""
+        resources: ["pods", "pods/status"]
+  # Log secrets access at Metadata level
+  - level: Metadata
+    resources:
+      - group: ""
+        resources: ["secrets", "configmaps"]
+  # Log all other requests at Metadata level
+  - level: Metadata
+    omitStages:
+      - "RequestReceived"
diff --git a/kubernetes/common.nix b/kubernetes/common.nix
index 12007bd..b6794cc 100644
--- a/kubernetes/common.nix
+++ b/kubernetes/common.nix
@@ -150,4 +150,6 @@
       rm -f "$TOKEN_FILE"
     '';
   };
+
+  environment.etc."kubernetes/audit-policy.yaml".source = ./audit-policy.yaml;
 }
diff --git a/kubernetes/flake.lock b/kubernetes/flake.lock
index dc9c41a..0bc9554 100644
--- a/kubernetes/flake.lock
+++ b/kubernetes/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1783522502,
-        "narHash": "sha256-iffAls3iaNTyJC2faYcUXSI+Gp02cDjYl+MygxKl2GI=",
+        "lastModified": 1784007870,
+        "narHash": "sha256-djcLt/JJphyNt4eDY9XTly+/WbCK5lqWq9lSgCmJkkQ=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "0bb7ec54c8483066ec9d7720e780a5caa71f8612",
+        "rev": "18b9261cb3294b6d2a06d03f96872827b8fe2698",
         "type": "github"
       },
       "original": {
diff --git a/kubernetes/master.nix b/kubernetes/master.nix
index f053101..a335ae3 100644
--- a/kubernetes/master.nix
+++ b/kubernetes/master.nix
@@ -16,8 +16,33 @@
     pki.genCfsslAPIToken = false; # We write a fixed token via k8s-write-apitoken service
     apiserver = {
       securePort = 6443;
-      allowPrivileged = true;
+      allowPrivileged = false;
+      anonymousAuth = false;
       serviceClusterIpRange = "10.96.0.0/12";
+      auditLog = {
+        enabled = true;
+        policyFile = "/etc/kubernetes/audit-policy.yaml";
+      };
+      admissionControl = [
+        "PodSecurity"
+        "NodeRestriction"
+        "AlwaysPullImages"
+        "EventRateLimit"
+      ];
+      encryptionConfig = {
+        enabled = true;
+        config = {
+          apiVersion = "apiserver.config.k8s.io/v1";
+          kind = "EncryptionConfiguration";
+          resources = [{
+            resources = ["secrets"];
+            providers = [
+              { aescbc = { keys = [{ name = "key1"; }]; }; }
+              { identity = {}; }
+            ];
+          }];
+        };
+      };
     };
     kubelet = {
       clusterDomain = "cluster.local";