diff --git a/lib/types/host.nix b/lib/types/host.nix
index c01d0a4..7677c33 100644
--- a/lib/types/host.nix
+++ b/lib/types/host.nix
@@ -258,6 +258,12 @@ in rec {
         default = { };
       };
 
+      hardened = mkOption {
+        type = bool;
+        description = "Harden the host, applying additional security.";
+        default = false;
+      };
+
       initrd-network = let
         keypair-type = { ... }: {
           options = {