diff --git a/gost.service b/gost.service
index 92aefac..e2b2f6f 100644
--- a/gost.service
+++ b/gost.service
@@ -18,6 +18,7 @@ Restart=on-failure
 RestartSec=1s
 
 AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
 
 PrivateTmp=yes
 PrivateDevices=no
@@ -32,7 +33,7 @@ ProtectClock=yes
 MemoryDenyWriteExecute=yes
 NoNewPrivileges=yes
 
-SystemCallFilter=~@mount @debug @cpu-emulation @obsolete
+SystemCallFilter=~@privileged @mount @debug @cpu-emulation @obsolete
 SystemCallErrorNumber=EPERM
 SystemCallArchitectures=native
 RestrictNamespaces=yes