diff --git a/init/systemd/dwelling-radio.service b/init/systemd/dwelling-radio.service
index 8641ce0..e947c84 100755
--- a/init/systemd/dwelling-radio.service
+++ b/init/systemd/dwelling-radio.service
@@ -4,12 +4,19 @@ After=network-online.target
 
 [Service]
 Type=simple
+Restart=on-failure
 User=dwradio
 Group=dwradio
 ExecStart=/usr/bin/dwelling-radio -conf /etc/dwelling/radio.yaml
+
+ReadOnlyPaths=/
+# Set here path to directory where uploads are stored.
+ReadWritePaths=/srv/upload
+NoExecPaths=/
+ExecPaths=/usr/bin/dwelling-radio /usr/lib64
+
 LogsDirectory=dwelling-radio
 RuntimeDirectory=dwelling-radio
-Restart=on-failure
 
 AmbientCapabilities=
 CapabilityBoundingSet=