diff --git a/modules/microvm.nix b/modules/microvm.nix
index ea4ead12..3e5f1883 100644
--- a/modules/microvm.nix
+++ b/modules/microvm.nix
@@ -64,6 +64,11 @@ in
   };
 
   config = {
+    boot.kernelParams = [
+      "preempt=none"
+      # No server/router runs any untrusted user code
+      "mitigations=off"
+    ];
     microvm = {
       hypervisor = lib.mkDefault "cloud-hypervisor";
       mem = lib.mkDefault 512;