diff --git a/lib/systemd/tio-trim-cache.service b/lib/systemd/tio-trim-cache.service
index 43a7514..ea92ae8 100644
--- a/lib/systemd/tio-trim-cache.service
+++ b/lib/systemd/tio-trim-cache.service
@@ -5,4 +5,7 @@ Description=Trim TIO's output cache
 Type=oneshot
 User=apache
 Group=apache
+ProtectSystem=strict
+ProtectHome=tmpfs
+ReadWritePaths=/srv/cache
 ExecStart=/srv/bin/trim-cache