diff --git a/kubernetes/common.nix b/kubernetes/common.nix
index 3cafcb4..12007bd 100644
--- a/kubernetes/common.nix
+++ b/kubernetes/common.nix
@@ -17,7 +17,7 @@
 
   # Networking
   networking.hostName = lib.mkDefault "k8s-node";
-  networking.firewall.enable = false; # Cilium manages iptables
+  networking.firewall.enable = true;
   networking.nameservers = [ "1.1.1.1" "8.8.8.8" ];
   networking.extraHosts = ''
     192.168.122.10 k8s-master-0
@@ -46,6 +46,9 @@
     "net.ipv6.conf.all.forwarding" = lib.mkForce 1;
     "fs.inotify.max_user_watches" = lib.mkForce 524288;
     "fs.inotify.max_user_instances" = lib.mkForce 8192;
+    "kernel.dmesg_restrict" = 1;
+    "kernel.kptr_restrict" = 2;
+    "fs.suid_dumpable" = 0;
   };
 
   # Container runtime
@@ -108,8 +111,10 @@
   # SSH for cluster communication
   services.openssh.enable = true;
   services.openssh.settings = {
-    PermitRootLogin = "yes";
+    PermitRootLogin = "prohibit-password";
     PasswordAuthentication = false;
+    AllowAgentForwarding = "no";
+    AllowTcpForwarding = "no";
   };
 
   # Authorized keys for cluster access
@@ -117,7 +122,6 @@
     openssh.authorizedKeys.keys = [
       sshPublicKey
     ];
-    initialPassword = "nixos";
   };
 
   # Time sync (critical for etcd)