diff --git a/systemd/mpd.service.in b/systemd/mpd.service.in
index 545c94159..c02f55e8d 100644
--- a/systemd/mpd.service.in
+++ b/systemd/mpd.service.in
@@ -9,6 +9,9 @@ ExecStart=@prefix@/bin/mpd --no-daemon
 LimitRTPRIO=50
 LimitRTTIME=infinity
 
+# disallow writing to /usr, /bin, /sbin, ...
+ProtectSystem=yes
+
 [Install]
 WantedBy=multi-user.target
 Also=mpd.socket