diff --git a/ProjectCode/ConfigFiles/NTP/ntp.conf b/ProjectCode/ConfigFiles/NTP/ntp.conf
index c53df06..717fcb1 100644
--- a/ProjectCode/ConfigFiles/NTP/ntp.conf
+++ b/ProjectCode/ConfigFiles/NTP/ntp.conf
@@ -8,7 +8,14 @@ leapfile /usr/share/zoneinfo/leap-seconds.list
 server 192.168.3.252 iburst
 server 192.168.3.253 iburst
 
+# Hardened client: sync from the configured servers but never serve time to
+# anyone else. Note: `interface listen 127.0.0.1` must NOT be used here — it
+# binds ntpd to loopback, making outbound queries carry a 127.0.0.1 source
+# address that upstream servers cannot reply to (symptoms: peers stuck in
+# .INIT. with reach 0). Use restrict rules to control access instead.
+restrict default ignore
 restrict 127.0.0.1
 restrict ::1
-interface ignore wildcard
-interface listen 127.0.0.1
+restrict 192.168.3.252 nomodify notrap nopeer
+restrict 192.168.3.253 nomodify notrap nopeer
+