diff --git a/roles/server/grafana.nix b/roles/server/grafana.nix
index 99eb5d9..957c41b 100644
--- a/roles/server/grafana.nix
+++ b/roles/server/grafana.nix
@@ -36,6 +36,9 @@ in {
         security = {
           admin_user = "$__file{${config.age.secrets.grafanaAdminName.path}}";
           admin_password = "$__file{${config.age.secrets.grafanaAdminPassword.path}}";
+          cookie_secure = true;
+          strict_transport_security = true;
+          content_security_policy = true;
         };
         server = {
           protocol = "socket";