diff --git a/build.gradle.kts b/build.gradle.kts
index 7a6895d..58abc91 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -10,6 +10,8 @@ plugins {
 group = "org.example"
 version = "1.0-SNAPSHOT"
 
+extra["tomcat.version"] = "9.0.99"
+
 repositories {
     mavenCentral()
 }
diff --git a/src/main/java/org/example/TomcatSecurityConfig.java b/src/main/java/org/example/TomcatSecurityConfig.java
new file mode 100644
index 0000000..ca06fb1
--- /dev/null
+++ b/src/main/java/org/example/TomcatSecurityConfig.java
@@ -0,0 +1,25 @@
+package org.example;
+
+import org.apache.catalina.Container;
+import org.apache.catalina.Wrapper;
+import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
+import org.springframework.boot.web.server.WebServerFactoryCustomizer;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration
+public class TomcatSecurityConfig {
+
+    @Bean
+    public WebServerFactoryCustomizer<TomcatServletWebServerFactory> tomcatHardeningCustomizer() {
+        return factory -> {
+            factory.addConnectorCustomizers(connector -> connector.setProperty("allowPartialPut", "false"));
+            factory.addContextCustomizers(context -> {
+                Container defaultServlet = context.findChild("default");
+                if (defaultServlet instanceof Wrapper) {
+                    ((Wrapper) defaultServlet).addInitParameter("readonly", "true");
+                }
+            });
+        };
+    }
+}