diff --git a/modules/config/sysctl.nix b/modules/config/sysctl.nix
index b0f3708dbb24..6b52fd38fdec 100644
--- a/modules/config/sysctl.nix
+++ b/modules/config/sysctl.nix
@@ -60,6 +60,10 @@ in
     boot.kernel.sysctl."fs.protected_hardlinks" = true;
     boot.kernel.sysctl."fs.protected_symlinks" = true;
 
+    # Hide kernel pointers (e.g. in /proc/modules) for unprivileged
+    # users as these make it easier to exploit kernel vulnerabilities.
+    boot.kernel.sysctl."kernel.kptr_restrict" = 1;
+
   };
 
 }