diff --git a/mod/freedom/unbound.nix b/mod/freedom/unbound.nix
index 61fbb1b..065839a 100644
--- a/mod/freedom/unbound.nix
+++ b/mod/freedom/unbound.nix
@@ -13,12 +13,14 @@ _:
         ];
         
         prefetch = true;
+        prefetch-key = true;
         qname-minimisation = true;
 
         hide-identity = true;
         hide-version = true;
 
         harden-glue = true;
+        harden-below-nxdomain = true;
         harden-dnssec-stripped = true;
       };
     };