diff --git a/pmoves/docker-compose.external.yml b/pmoves/docker-compose.external.yml
index ce8336b61b..ec2812e672 100644
--- a/pmoves/docker-compose.external.yml
+++ b/pmoves/docker-compose.external.yml
@@ -59,6 +59,34 @@ services:
     volumes:
       - firefly-storage:/var/www/html/storage
       - ./integrations/pr-kits/firefly/nginx-buffers.conf:/etc/nginx/conf.d/zz_buffers.conf:ro
+    # Security hardening
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    cap_add:
+      - CHOWN
+      - SETGID
+      - SETUID
+    tmpfs:
+      - /tmp:noexec,nosuid
+      - /var/www/html/storage/framework/sessions:noexec,nosuid
+      - /var/www/html/storage/framework/views:noexec,nosuid
+      - /var/www/html/storage/framework/cache:noexec,nosuid
+    healthcheck:
+      test: ["CMD-SHELL", "curl -sf http://localhost:8080/api/v1/about || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+    deploy:
+      resources:
+        limits:
+          cpus: '2.0'
+          memory: 1G
+        reservations:
+          cpus: '0.5'
+          memory: 256M
 
   open-notebook-surrealdb-ext:
     image: ${OPEN_NOTEBOOK_SURREAL_IMAGE:-surrealdb/surrealdb:v2}