diff --git a/units/var-lock.mount b/units/var-lock.mount
index f14ea94d04..0ea2599b71 100644
--- a/units/var-lock.mount
+++ b/units/var-lock.mount
@@ -13,4 +13,4 @@ Before=local-fs.target
 What=tmpfs
 Where=/var/lock
 Type=tmpfs
-Options=mode=775,gid=lock
+Options=mode=775,gid=lock,nosuid,nodev,noexec
diff --git a/units/var-run.mount b/units/var-run.mount
index f786289536..8ccb4bb28e 100644
--- a/units/var-run.mount
+++ b/units/var-run.mount
@@ -13,4 +13,4 @@ Before=local-fs.target
 What=tmpfs
 Where=/var/run
 Type=tmpfs
-Options=mode=755
+Options=mode=755,nosuid,nodev,noexec