diff --git a/conf/pict-rs.service b/conf/pict-rs.service
index 3ab017b..90785ba 100644
--- a/conf/pict-rs.service
+++ b/conf/pict-rs.service
@@ -16,31 +16,31 @@ StandardError=inherit
 # Depending on specificities of your service/app, you may need to tweak these 
 # .. but this should be a good baseline
 # Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
-#NoNewPrivileges=yes
-#PrivateTmp=yes
-#PrivateDevices=yes
-#RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
-#RestrictNamespaces=yes
-#RestrictRealtime=yes
-#DevicePolicy=closed
-#ProtectSystem=full
-#ProtectControlGroups=yes
-#ProtectKernelModules=yes
-#ProtectKernelTunables=yes
-#LockPersonality=yes
-#SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+RestrictNamespaces=yes
+RestrictRealtime=yes
+DevicePolicy=closed
+ProtectSystem=full
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+LockPersonality=yes
+SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
 
 # Denying access to capabilities that should not be relevant for webapps
 # Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
-#CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
-#CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
-#CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
-#CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
-#CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
-#CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
-#CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
-#CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
-#CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG 
+CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
+CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
+CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
+CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
+CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
+CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
+CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
+CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
+CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG 
 
 [Install]
 WantedBy=multi-user.target
diff --git a/scripts/_common.sh b/scripts/_common.sh
index 1cced56..9dc29f7 100644
--- a/scripts/_common.sh
+++ b/scripts/_common.sh
@@ -16,6 +16,36 @@ NODEJS_VERSION=20
 # EXPERIMENTAL HELPERS
 #=================================================
 
+# Downloads an AppImage from an url, unpacks and extracts it in a destination directory, and creates a symlink to its executable
+download_and_install_appimage() {
+
+    # Declare an array to define the options of this helper.
+    local legacy_args=nud
+    local -A args_array=([n]=name= [u]=url= [d]=directory= [s]=symlink=)
+    local url
+    local directory
+    local name
+    # Manage arguments with getopts
+    ynh_handle_getopts_args "$@"
+
+    # Cleanup
+    ynh_secure_remove --file="$install_dir/pict-rs/$name"
+    ynh_secure_remove --file="$install_dir/pict-rs/$name.appimage"
+    ynh_secure_remove --file="$install_dir/pict-rs/$name.appimageextract"
+
+    # Download and make executable
+    curl -f "$url" -o "$directory/$name.appimage" -s
+    [ ! -f "$directory/$name.appimage" ] && ynh_print_err --message="AppImage could not be downloaded"
+    chmod +x "$directory/$name.appimage"
+
+    # Extract and create link
+    pushd "$directory"
+        "$directory/$name.appimage" --appimage-extract
+        mv "$directory/squashfs-root" "$directory/$name.appimageextract"
+        ln -s "$directory/$name.appimageextract/AppRun" "$directory/$name"
+    popd
+}
+
 #=================================================
 # FUTURE OFFICIAL HELPERS
 #=================================================
diff --git a/scripts/install b/scripts/install
index a0506f4..6262d04 100755
--- a/scripts/install
+++ b/scripts/install
@@ -91,10 +91,8 @@ chown -R $app:$app "$install_dir"
 
 # (Dirty) Install ImageMagick
 # Requires 'libfuse2' and 'libimage-exiftool-perl' apt dependencies
-curl -f https://imagemagick.org/archive/binaries/magick -o "$install_dir/pict-rs/magick" -s
-[ ! -f "$install_dir/pict-rs/magick" ] && ynh_print_err --message="ImageMagick could not be downloaded"
-chmod 750 "$install_dir/pict-rs/magick"
-chown $app:$app "$install_dir/pict-rs/magick"
+ynh_script_progression --message="Downloading and installing ImageMagick..." --weight=1
+download_and_install_appimage --name="magick" --url="https://imagemagick.org/archive/binaries/magick" --directory="$install_dir/pict-rs" --symlink="$install_dir/pict-rs/magick"
 
 #=================================================
 # ADD A CONFIGURATION
diff --git a/scripts/upgrade b/scripts/upgrade
index 18fb23b..48c0c12 100644
--- a/scripts/upgrade
+++ b/scripts/upgrade
@@ -130,11 +130,8 @@ then
 
 	# (Dirty) Install ImageMagick
 	# Requires 'libfuse2' and 'libimage-exiftool-perl' apt dependencies
-	curl -f https://imagemagick.org/archive/binaries/magick -o "$install_dir/pict-rs/magick" -s
-	[ ! -f "$install_dir/pict-rs/magick" ] && ynh_print_err --message="ImageMagick could not be downloaded"
-	chmod 750 "$install_dir/pict-rs/magick"
-	chown $app:$app "$install_dir/pict-rs/magick"
-
+	ynh_script_progression --message="Downloading and installing ImageMagick..." --weight=1
+	download_and_install_appimage --name="magick" --url="https://imagemagick.org/archive/binaries/magick" --directory="$install_dir/pict-rs" --symlink="$install_dir/pict-rs/magick"
 fi
 
 chmod 750 "$install_dir"