diff --git a/roles/cups/server/tasks/main.yml b/roles/cups/server/tasks/main.yml
index bd1bcbe..19cc9ed 100644
--- a/roles/cups/server/tasks/main.yml
+++ b/roles/cups/server/tasks/main.yml
@@ -35,6 +35,29 @@
     line: "DefaultAuthType Negotiate"
   notify: restart cups
 
+- name: disable printer advertising
+  lineinfile:
+    path: /etc/cups/cupsd.conf
+    regexp: "^Browsing .*"
+    line: "Browsing No"
+  notify: restart cups
+
+- name: disable unauthenticated access from cups
+  blockinfile:
+    path: /etc/cups/cupsd.conf
+    insertafter: "^<Location />"
+    block: |
+      AuthType Default
+      Require user @foosh
+  notify: restart cups
+
+- name: configure cups admin group
+  lineinfile:
+    path: /etc/cups/cups-files.conf
+    regexp: "^SystemGroup .*"
+    line: "SystemGroup root sysadm"
+  notify: restart cups
+
 - name: disable cups socket service
   systemd:
     name: cups.socket