diff --git a/hosts/kuro/hardware-configuration.nix b/hosts/kuro/hardware-configuration.nix
index 9a083880..f95eb2e8 100644
--- a/hosts/kuro/hardware-configuration.nix
+++ b/hosts/kuro/hardware-configuration.nix
@@ -75,12 +75,18 @@
     "/usr/drive" = {
       device = "kiiro:/volume1/homes/hlissner/Drive";
       fsType = "nfs";
-      options = [ "nofail" "noauto" "x-systemd.automount" "x-systemd.idle-timeout=5min" ];
+      options = [
+        "nofail" "noauto" "noatime" "x-systemd.automount" "x-systemd.idle-timeout=5min"
+        "nodev" "nosuid" "noexec"
+      ];
     };
     "/usr/store" = {
       device = "/dev/disk/by-label/store";
       fsType = "ext4";
-      options = [ "noauto" "noatime" "x-systemd.automount" "x-systemd.idle-timeout=5min" ];
+      options = [
+        "noauto" "noatime" "x-systemd.automount" "x-systemd.idle-timeout=5min"
+        "nodev" "nosuid" "noexec"
+      ];
     };
   };
   swapDevices = [];
diff --git a/hosts/shiro/hardware-configuration.nix b/hosts/shiro/hardware-configuration.nix
index 91c483e5..1b5f1f28 100644
--- a/hosts/shiro/hardware-configuration.nix
+++ b/hosts/shiro/hardware-configuration.nix
@@ -63,7 +63,10 @@
     "/usr/drive" = {
       device = "kiiro:/volume1/homes/hlissner/Drive";
       fsType = "nfs";
-      options = [ "nofail" "noauto" "x-systemd.automount" ];
+      options = [
+        "nofail" "noauto" "noatime" "x-systemd.automount"
+        "nodev" "nosuid" "noexec"
+      ];
     };
   };
   swapDevices = [ { device = "/dev/disk/by-label/swap"; }];