diff --git a/nix/pkgs/pomerium/module.nix b/nix/pkgs/pomerium/module.nix
index eeb13c9150..14b367f753 100644
--- a/nix/pkgs/pomerium/module.nix
+++ b/nix/pkgs/pomerium/module.nix
@@ -41,6 +41,7 @@ with lib;
         StateDirectory = "pomerium";
 
         PrivateUsers = !cfg.bindLowPort;  # breaks CAP_NET_BIND_SERVICE
+        MemoryDenyWriteExecute = false;  # breaks LuaJIT
 
         NoNewPrivileges = true;
         PrivateTmp = true;
@@ -56,8 +57,8 @@ with lib;
         RestrictNamespaces = true;
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
-        MemoryDenyWriteExecute = true;
         LockPersonality = true;
+        SystemCallArchitectures = "native";
 
         EnvironmentFile = cfg.secretsFile;
         AmbientCapabilities = lib.mkIf cfg.bindLowPort [ "CAP_NET_BIND_SERVICE" ];