diff --git a/hosts/guard/pacman-hooks/pacman-post-relock-hosts.sh b/hosts/guard/pacman-hooks/pacman-post-relock-hosts.sh
index 83ab351..abc0bf0 100644
--- a/hosts/guard/pacman-hooks/pacman-post-relock-hosts.sh
+++ b/hosts/guard/pacman-hooks/pacman-post-relock-hosts.sh
@@ -7,46 +7,50 @@ TARGET=/etc/hosts
 ENFORCE=/usr/local/sbin/enforce-hosts.sh
 LOGTAG=hosts-guard-hook
 
-mount_layers_count() { awk '$5=="/etc/hosts"{c++} END{print c+0}' /proc/self/mountinfo 2> /dev/null || echo 0; }
+mount_layers_count() { awk '$5=="/etc/hosts"{c++} END{print c+0}' /proc/self/mountinfo 2>/dev/null || echo 0; }
 collapse_mounts() {
-  local i=0
-  if command -v mountpoint > /dev/null 2>&1; then
-    while mountpoint -q "$TARGET"; do
-      umount -l "$TARGET" > /dev/null 2>&1 || break
-      i=$((i + 1))
-      ((i > 20)) && break
-    done
-  else
-    local cnt
-    cnt=$(mount_layers_count)
-    while ((cnt > 1)); do
-      umount -l "$TARGET" > /dev/null 2>&1 || break
-      i=$((i + 1))
-      ((i > 20)) && break
-      cnt=$(mount_layers_count)
-    done
-  fi
+	local i=0
+	if command -v mountpoint >/dev/null 2>&1; then
+		while mountpoint -q "$TARGET"; do
+			umount -l "$TARGET" >/dev/null 2>&1 || break
+			i=$((i + 1))
+			((i > 20)) && break
+		done
+	else
+		local cnt
+		cnt=$(mount_layers_count)
+		while ((cnt > 1)); do
+			umount -l "$TARGET" >/dev/null 2>&1 || break
+			i=$((i + 1))
+			((i > 20)) && break
+			cnt=$(mount_layers_count)
+		done
+	fi
 }
 
 # Ensure we end with a single read-only bind mount layer
 logger -t "$LOGTAG" "post: relocking /etc/hosts (starting)"
-echo "$(date -Is) post-relock(start)" >> /run/hosts-guard-hook.log 2> /dev/null || true
+echo "$(date -Is) post-relock(start)" >>/run/hosts-guard-hook.log 2>/dev/null || true
 collapse_mounts
 
 if [[ -x $ENFORCE ]]; then
-  "$ENFORCE" > /dev/null 2>&1 || true
+	"$ENFORCE" >/dev/null 2>&1 || true
+fi
+
+if command -v chattr >/dev/null 2>&1; then
+	chattr +i "$TARGET" >/dev/null 2>&1 || true
 fi
 
 # Apply exactly one ro bind layer
-mount --bind "$TARGET" "$TARGET" > /dev/null 2>&1 || true
-mount -o remount,ro,bind "$TARGET" > /dev/null 2>&1 || true
+mount --bind "$TARGET" "$TARGET" >/dev/null 2>&1 || true
+mount -o remount,ro,bind "$TARGET" >/dev/null 2>&1 || true
 
 # Start only the path watcher; avoid bind-mount service (we already bound once)
-if command -v systemctl > /dev/null 2>&1; then
-  systemctl start hosts-guard.path > /dev/null 2>&1 || true
+if command -v systemctl >/dev/null 2>&1; then
+	systemctl start hosts-guard.path >/dev/null 2>&1 || true
 fi
 
 logger -t "$LOGTAG" "post: relocking /etc/hosts (done)"
-echo "$(date -Is) post-relock(done)" >> /run/hosts-guard-hook.log 2> /dev/null || true
+echo "$(date -Is) post-relock(done)" >>/run/hosts-guard-hook.log 2>/dev/null || true
 
 exit 0