{
  config,
  lib,
  ...
}: let
  cfg = config.hardened;
in {
  config = lib.mkIf cfg.kernel.hardened {
    boot.kernel.sysctl = {
      "kernel.kptr_restrict" = 2;
      "kernel.dmesg_restrict" = 1;
      "kernel.unprivileged_bpf_disabled" = 1;
      "net.core.bpf_jit_harden" = 2;
      "fs.suid_dumpable" = 0;
      "kernel.sysrq" = 0;
    };

    boot.kernelParams = [
      "lockdown=confidentiality"
      "module.sig_enforce=1"
      "slab_nomerge"
      "init_on_alloc=1"
      "init_on_free=1"
    ];
  };
}