diff --git a/docs/gentoo-desktop-setup/installation.md b/docs/gentoo-desktop-setup/installation.md
index c8afd4e..8943a83 100644
--- a/docs/gentoo-desktop-setup/installation.md
+++ b/docs/gentoo-desktop-setup/installation.md
@@ -83,7 +83,7 @@ PORTAGE_LOGDIR_CLEAN="find \"\${PORTAGE_LOGDIR}\" -type f ! -name \"summary.log*
 ACCEPT_LICENSE="-* @FREE"
 
 # USE flags
-USE="${USE} networkmanager -modemmanager wayland dbus elogind -systemd policykit pam man udev pipewire initramfs secureboot modules-sign dist-kernel" # ....
+USE="${USE} networkmanager -modemmanager wayland dbus elogind -systemd policykit pam apparmor man udev pipewire initramfs secureboot modules-sign dist-kernel" # ....
 
 # Emerge settings
 EMERGE_DEFAULT_OPTS="${EMERGE_DEFAULT_OPTS} --with-bdeps y"
diff --git a/docs/gentoo-desktop-setup/post-install/security.md b/docs/gentoo-desktop-setup/post-install/security.md
new file mode 100644
index 0000000..fbbec2e
--- /dev/null
+++ b/docs/gentoo-desktop-setup/post-install/security.md
@@ -0,0 +1,20 @@
+Security is an important factor when it comes to an operating system. Hardening the system is done to prevent as many exploits as possible. There are multiple factors which should be considered.
+
+## Apparmor and LSM
+
+Apparmor is a Mandatory Access Control (MAC) system that restricts capabilities from a program on a computer. It can dissallow access to files which the program would not require. Make sure the `apparmor` USE flag is enabled and install the necessary programs:
+
+``` shell-session
+sh# emerge -av apparmor apparmor-utils
+sh# rc-update add apparmor boot
+```
+
+Then add apparmor and other Linux Security Modules (LSM) to the `cmdline` and rebuild the initramfs:
+
+``` title="/etc/kernel/cmdline"
+... apparmor=1 lsm=landlock,lockdown,yama,capability,integrity,apparmor
+```
+
+``` shell-session
+sh# emerge --config gentoo-kernel # or gentoo-kernel-bin etc.
+```
diff --git a/mkdocs.yml b/mkdocs.yml
index 2dd952d..1e5d2af 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -101,6 +101,7 @@ nav:
       - 'Swap': gentoo-desktop-setup/post-install/swap.md
       - 'Users': gentoo-desktop-setup/post-install/users.md
       - 'Ccache': gentoo-desktop-setup/post-install/ccache.md
+      - 'Security': gentoo-desktop-setup/post-install/security.md
     - 'Graphical session':
       - 'Session manager': gentoo-desktop-setup/graphical-session/session-manager.md
       - 'Login manager': gentoo-desktop-setup/graphical-session/login-manager.md