diff --git a/playbooks/phrik.yml b/playbooks/phrik.yml
index 1e56a2ae7add1a0866eac260515fa40c511bd4a2..9905614fc079c15f21da0679bef674d1a52a3f3c 100644
--- a/playbooks/phrik.yml
+++ b/playbooks/phrik.yml
@@ -7,6 +7,7 @@
     - { role: common }
     - { role: tools }
     - { role: archusers }
+    - { role: bugbot }
     - { role: phrik }
     - { role: sshd }
     - { role: unbound }
diff --git a/roles/bugbot/defaults/main.yml b/roles/bugbot/defaults/main.yml
index c9f3a7f1e3b05a8208211490acb449f1b34c78fc..32814d295895a6fdf1dc3ec97c11bb270381e326 100644
--- a/roles/bugbot/defaults/main.yml
+++ b/roles/bugbot/defaults/main.yml
@@ -2,7 +2,9 @@
 irc_host: 'chat.freenode.net'
 irc_port: '6697'
 irc_channel: '#archlinux-bugs'
-bugbot_version: 20200630
+bugbot_version: '20200630'
+bugbot_pgp_keys: ['92D9C6CDE99A2024D690A76EE742683BA08CB2FF']
+bugbot_pgp_emails: ['foxboron@archlinux.org']
 bugbot_admins:
   - keenerd
   - falconindy
diff --git a/roles/bugbot/files/bugbot.service b/roles/bugbot/files/bugbot.service
index 1775f220ae0539a1c653c1e5fdb1b7b3af38afd8..d18d809f75aebd87859f783fe361e570b114e142 100644
--- a/roles/bugbot/files/bugbot.service
+++ b/roles/bugbot/files/bugbot.service
@@ -8,10 +8,14 @@ Restart=on-failure
 ProtectSystem=strict
 DynamicUser=yes
 PrivateDevices=true
+PrivateUsers=true
 ProtectKernelTunables=true
 ProtectControlGroups=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
 MemoryDenyWriteExecute=true
 NoNewPrivileges=true
+RestrictRealtime=true
 
 
 [Install]
diff --git a/roles/bugbot/tasks/main.yml b/roles/bugbot/tasks/main.yml
index 714f4c6efb7aed1d8b62cd395704ef1abbe12d16..4d46b8190af79971378163a7688c618d19154b2d 100644
--- a/roles/bugbot/tasks/main.yml
+++ b/roles/bugbot/tasks/main.yml
@@ -3,13 +3,21 @@
 - name: install bugbot utilities
   pacman: name=python-irc,python-beautifulsoup4,python-lxml state=present
 
+- name: receive valid signing keys
+  become: true
+  command: /usr/bin/gpg --keyserver keys.openpgp.org --auto-key-locate wkd,keyserver --locate-keys {{ item }}
+  with_items: '{{ bugbot_pgp_emails }}'
+  register: gpg
+  changed_when: "gpg.rc == 0"
+
 - name: clone bugbot source
   git:
     repo: https://gitlab.archlinux.org/archlinux/bugbot.git
     dest: /srv/bugbot
     force: true
     verify_commit: true
-    version: "{{ bugbot_version }}"
+    gpg_whitelist: '{{ bugbot_pgp_keys }}'
+    version: '{{ bugbot_version }}'
 
 - name: install env file
   template: src=bugbot.j2 dest=/srv/bugbot/env owner=root group=root mode=0600