diff --git a/cluster/nix/cluster-configuration.nix b/cluster/nix/cluster-configuration.nix
index 7357f14..fdfcbed 100644
--- a/cluster/nix/cluster-configuration.nix
+++ b/cluster/nix/cluster-configuration.nix
@@ -161,7 +161,7 @@
       serviceClusterIpRange = "10.10.12.0/24";
       runtimeConfig = "api/all,authentication.k8s.io/v1beta1";
       authorizationMode = ["Node" "RBAC"];
-      enableAdmissionPlugins = ["Initializers" "NamespaceLifecycle" "NodeRestriction" "LimitRanger" "ServiceAccount" "DefaultStorageClass" "ResourceQuota"];
+      enableAdmissionPlugins = ["Initializers" "NamespaceLifecycle" "NodeRestriction" "LimitRanger" "ServiceAccount" "DefaultStorageClass" "ResourceQuota" "PodSecurityPolicy"];
       extraOpts = ''
         --apiserver-count=3 \
         --proxy-client-cert-file=${pki.kubeFront.apiserver.cert} \