diff --git a/config/rootfiles/core/170/update.sh b/config/rootfiles/core/170/update.sh
index 8dc99e5d8..9e96e3467 100644
--- a/config/rootfiles/core/170/update.sh
+++ b/config/rootfiles/core/170/update.sh
@@ -123,6 +123,9 @@ sed -i /etc/collectd.conf \
 /etc/init.d/rc.d/unbound start
 /etc/init.d/rc.d/suricata restart
 
+# Harden mount options of /boot
+sed -e -i "s@[[:space:]]*\/boot[[:space:]]*auto[[:space:]]*defaults[[:space:]]*@ \/boot    auto defaults,nodev,noexec,nosuid   @g" /etc/fstab
+
 # This update needs a reboot...
 touch /var/run/need_reboot