diff --git a/share/common.nix b/share/common.nix
index b91fcb0..f2310c1 100644
--- a/share/common.nix
+++ b/share/common.nix
@@ -198,6 +198,9 @@ in
   # allow realtime
   security.rtkit.enable = true;
 
+  # no need to replace the kernel at runtime
+  security.protectKernelImage = true;
+
   # package manager config
   nix = {
     # auto optimize the store