diff --git a/modlists/base b/modlists/base
index 268a4ab..20022b8 100644
--- a/modlists/base
+++ b/modlists/base
@@ -2,6 +2,7 @@ folder-structure
 sources
 disable-mandb
 bfq
+mitigations
 packages-base
 hostname
 user-config
diff --git a/mods/mitigations/data/etc/default/grub.d/mitigations.cfg b/mods/mitigations/data/etc/default/grub.d/mitigations.cfg
new file mode 100644
index 0000000..3154cfc
--- /dev/null
+++ b/mods/mitigations/data/etc/default/grub.d/mitigations.cfg
@@ -0,0 +1 @@
+GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT mitigations=auto,nosmt"