Changes

diff --git a/model-switcher/model-switcher.service.example b/model-switcher/model-switcher.service.example
index cc4d2e2..e2eb2cc 100644
--- a/model-switcher/model-switcher.service.example
+++ b/model-switcher/model-switcher.service.example
@@ -15,5 +15,36 @@ ExecStart=/usr/bin/python3 main.py --host 0.0.0.0 --port 7330
 Restart=always
 RestartSec=5
 
+# --- Security & Sandboxing ---
+
+# Hide user home directories
+ProtectHome=yes
+
+# Use a private /tmp and /var/tmp
+PrivateTmp=yes
+
+# Mount /usr, /boot, and /etc as read-only
+ProtectSystem=full
+
+# EXCEPTION: Allow writing to /etc because the script needs to update 
+# the symlink at /etc/llama.cpp.conf.
+# (If the symlink were in a subdirectory, we could restrict this further)
+ReadWritePaths=/etc
+
+# Prevent modifying kernel variables
+ProtectKernelTunables=yes
+
+# Prevent accessing control groups
+ProtectControlGroups=yes
+
+# Prevent loading new kernel modules
+ProtectKernelModules=yes
+
+# Prevent changing the hostname
+ProtectHostname=yes
+
+# Restrict networking to IPv4/IPv6 and Unix Sockets (needed for systemd/journald communication)
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+
 [Install]
 WantedBy=multi-user.target