diff --git a/modules/nixos/archetypes/server/default.nix b/modules/nixos/archetypes/server/default.nix
index 222e633..4ee1041 100644
--- a/modules/nixos/archetypes/server/default.nix
+++ b/modules/nixos/archetypes/server/default.nix
@@ -34,5 +34,8 @@ in {
 
     # Enable SSH for remote login
     services.openssh.enable = true;
+
+    # SSH rate-limiting and bans
+    services.fail2ban.enable = true;
   };
 }