diff --git a/nixos/modules/services/continuous-integration/jenkins/default.nix b/nixos/modules/services/continuous-integration/jenkins/default.nix
index 2dae8b61296c..8ec7c972436b 100644
--- a/nixos/modules/services/continuous-integration/jenkins/default.nix
+++ b/nixos/modules/services/continuous-integration/jenkins/default.nix
@@ -251,24 +251,30 @@ in
 
       serviceConfig = {
         User = cfg.user;
+        Group = cfg.group;
         StateDirectory = lib.mkIf (lib.hasPrefix "/var/lib/jenkins" cfg.home) "jenkins";
+        StateDirectoryMode = "750";
         # For (possible) socket use
         RuntimeDirectory = "jenkins";
+        RuntimeDirectoryMode = "750";
         AmbientCapabilities = "";
         CapabilityBoundingSet = "";
         LockPersonality = true;
         # MemoryDenyWriteExecute = false;   Breaks execution;
+        MountAPIVFS = true;
         NoNewPrivileges = true;
         PrivateDevices = true;
         PrivateMounts = true;
         PrivateTmp = true;
+        PrivateUsers = true;
         ProtectClock = true;
-        ProtectControlGroups = true;
+        ProtectControlGroups = "strict";
         ProtectHome = true;
         ProtectHostname = true;
         ProtectKernelLogs = true;
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
+        ProtectProc = "invisible";
         ProtectSystem = "full";
         RemoveIPC = true;
         RestrictAddressFamilies = [