diff --git a/hosts/winter/security.nix b/hosts/winter/security.nix
index 78748e5..0cfde8e 100644
--- a/hosts/winter/security.nix
+++ b/hosts/winter/security.nix
@@ -1,6 +1,11 @@
 { config, pkgs, ... }: {
   networking.firewall.enable = false;
-  services.openssh.enable = true;
+
+  services.openssh = {
+    enable = true;
+    permitRootLogin = "no";
+    passwordAuthentication = false;
+  };
 
   security = {
     polkit.enable = true;