diff --git a/src/concepts/plugin.rs b/src/concepts/plugin.rs
index 204f6f2..c5bc330 100644
--- a/src/concepts/plugin.rs
+++ b/src/concepts/plugin.rs
@@ -53,6 +53,8 @@ fn systemd_default_options(working_directory: &str) -> BTreeMap<String, Vec<Stri
             // Various Protections
             ("LockPersonality", vec!["true"]),
             ("NoNewPrivileges", vec!["true"]),
+            ("AmbientCapabilities", vec![""]),
+            ("CapabilityBoundingSet", vec![""]),
             // Isolate File
             ("RemoveIPC", vec!["true"]),
             ("RestrictNamespaces", vec!["true"]),
@@ -67,7 +69,6 @@ fn systemd_default_options(working_directory: &str) -> BTreeMap<String, Vec<Stri
             // ("DynamicUser", vec!["true"]),
             // ("User", vec!["reaction-plugin-test"]),
             // Too restrictive
-            // ("CapabilityBoundingSet", vec![""]),
             // ("NoExecPaths", vec!["/"]),
             // ("RestrictAddressFamilies", vec![""]),
         ]
diff --git a/tests/test-conf/test-ipset.jsonnet b/tests/test-conf/test-ipset.jsonnet
index 02df038..13c4c21 100644
--- a/tests/test-conf/test-ipset.jsonnet
+++ b/tests/test-conf/test-ipset.jsonnet
@@ -13,7 +13,7 @@
       path: './target/debug/reaction-plugin-ipset',
       check_root: false,
       systemd_options: {
-        AmbientCapabilities: ['CAP_NET_ADMIN'],
+        CapabilityBoundingSet: ['~CAP_NET_ADMIN', '~CAP_PERFMON'],
       },
     },
   },