diff --git a/flake.nix b/flake.nix
index db2a672..b0cda80 100644
--- a/flake.nix
+++ b/flake.nix
@@ -151,7 +151,8 @@
                 serviceConfig = {
                   EnvironmentFile = lib.mkForce "/var/lib/lamassu-atm/.env";
                   Environment = "LD_LIBRARY_PATH=${pkgs.stdenv.cc.cc.lib}/lib";
-                  ExecStart = lib.mkForce "${pkgs-unstable.electron}/bin/electron --no-sandbox --disable-gpu-sandbox --disable-gpu --enable-logging ${atm-app}";
+                  ExecStart = lib.mkForce "${pkgs-unstable.electron}/bin/electron --no-sandbox --disable-gpu-sandbox --disable-gpu --disable-software-rasterizer --enable-logging ${atm-app}";
+                  MemoryMax = lib.mkForce "1G";
                   NoNewPrivileges = lib.mkForce false;
                   ProtectSystem = lib.mkForce false;
                   ProtectHome = lib.mkForce false;
@@ -176,6 +177,12 @@
                 };
               };
 
+              # Swap file — ATMs have ~2GB RAM; prevents hard-freeze under memory pressure
+              swapDevices = [{ device = "/var/swapfile"; size = 1024; }];
+
+              # Clean /tmp on boot to prevent stale build artifacts filling disk
+              boot.tmp.cleanOnBoot = true;
+
               # SSH with password for initial provisioning
               services.openssh.settings.PasswordAuthentication = lib.mkForce true;
             })