diff --git a/etc/base b/etc/base
index ae7d5da..535ab1f 100644
--- a/etc/base
+++ b/etc/base
@@ -43,7 +43,7 @@ EOF
 if [ "$EFI" == "1" ]; then
 	uuid=$(blkid -o value -s UUID ${TARGET_PHY_ID}-part1)
 	echo "UUID=${uuid} 	/boot/efi 	vfat 	defaults 	0 0" >> /etc/fstab
-	echo "efivarfs /sys/firmware/efi/efivars efivarfs defaults 0 0" >> /etc/fstab
+	echo "efivarfs /sys/firmware/efi/efivars efivarfs defaults,nosuid,nodev,noexec 0 0" >> /etc/fstab
 else
 	if [ "${ENCRYPTION_STYLE}" == "e" ]; then
 		uuid=$(blkid -o value -s UUID ${TARGET_PHY_ID}-part1)