diff --git a/modules/router/timeserver.nix b/modules/router/timeserver.nix
index 2b361d3..5a669f8 100644
--- a/modules/router/timeserver.nix
+++ b/modules/router/timeserver.nix
@@ -20,17 +20,33 @@ in {
   config = mkIf cfg.timeserver.enable {
     networking.timeServers = [
       "time.cloudflare.com"
-      "uk.pool.ntp.org"
+      "ntppool1.time.nl"
+      "ptbtime1.ptb.de"
     ];
 
     services.chrony = {
       enable = true;
+      extraFlags = mkDefault [
+        "-F 1" # seccomp filter
+        "-r" # reload history on restart
+      ];
+      initstepslew.enabled = mkDefault false;
+      enableRTCTrimming = mkDefault false;
+      enableNTS = mkDefault true;
       extraConfig = ''
+        minsources 3
+        authselectmode require
+        dscp 46
+        makestep 1.0 3
+        cmdport 0
+        noclientlog
+        ${strings.optionalString (!config.services.chrony.enableRTCTrimming) "rtcsync"}
         allow all
         ${bindDevices}
       '';
     };
 
+    services.timesyncd.enable = false;
     services.ntp.enable = false;
     services.openntpd.enable = false;
   };
diff --git a/modules/server/sshd.nix b/modules/server/sshd.nix
index 17e3f0a..b6c42d4 100644
--- a/modules/server/sshd.nix
+++ b/modules/server/sshd.nix
@@ -21,6 +21,7 @@ in {
     services.openssh = {
       enable = true;
     } // helpers.linuxAttrs {
+      settings.PermitRootLogin = mkDefault "no";
       openFirewall = mkDefault (!config.modules.router.enable);
       ports = [ 22 2222 ];
     };