diff --git a/assets/configuration-profiles/BlockMDMUnenrollment.xml b/assets/configuration-profiles/BlockMDMUnenrollment.xml
new file mode 100644
index 0000000000..acd5994f64
--- /dev/null
+++ b/assets/configuration-profiles/BlockMDMUnenrollment.xml
@@ -0,0 +1,13 @@
+<Replace>
+  <CmdID>25</CmdID>
+  <Item>
+    <Target>
+      <LocURI>./Device/Vendor/MSFT/Policy/Config/Experience/AllowManualMDMUnenrollment</LocURI>
+    </Target>
+    <Meta>
+      <Format xmlns="syncml:metinf">int</Format>
+      <Type>text/plain</Type>
+    </Meta>
+    <Data>0</Data>
+  </Item>
+</Replace>
\ No newline at end of file
diff --git a/assets/policies/windows-fleet-hardening.policies.yml b/assets/policies/windows-fleet-hardening.policies.yml
new file mode 100644
index 0000000000..212403c239
--- /dev/null
+++ b/assets/policies/windows-fleet-hardening.policies.yml
@@ -0,0 +1,5 @@
+- name: Windows - Hide uninstall and modify options for Fleet osquery
+  platform: windows
+  description: "This policy checks if the uninstall and modify options are hidden for Fleet osquery by ensuring both the NoRemove and NoModify registry values are set to 1."
+  resolution: "As an IT admin, set the NoRemove and NoModify registry values to 1 under the Fleet osquery uninstall key to prevent users from uninstalling or modifying the agent."
+  query: SELECT CASE WHEN COUNT(*) = 1 THEN 1 ELSE 0 END AS compliant FROM registry nr JOIN registry d ON d.path = REPLACE(nr.path, '\NoRemove', '\DisplayName') JOIN registry nm ON nm.path = REPLACE(nr.path, '\NoRemove', '\NoModify') WHERE nr.path LIKE 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%\NoRemove' AND d.data = 'Fleet osquery' AND nr.data = '1' AND nm.data = '1';
diff --git a/assets/scripts/windows-fleet-hardening.ps1 b/assets/scripts/windows-fleet-hardening.ps1
new file mode 100644
index 0000000000..0b3ce09f02
--- /dev/null
+++ b/assets/scripts/windows-fleet-hardening.ps1
@@ -0,0 +1,27 @@
+# Prevents uninstall/change of Fleet osquery via Windows UI.
+# Sets NoRemove and NoModify = 1 under Fleet osquery uninstall entry.
+# Hides uninstall/change options across Control Panel and Settings > Apps.
+# Works on all Windows editions.
+
+$UninstallPaths = @(
+    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
+    "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"
+)
+
+$FleetEntry = Get-ItemProperty -Path $UninstallPaths -ErrorAction SilentlyContinue |
+              Where-Object { $_.DisplayName -like "Fleet osquery*" }
+
+if ($FleetEntry) {
+    Write-Output "[INFO] Fleet osquery found: $($FleetEntry.DisplayName)"
+    $RegKeyPath = $FleetEntry.PSPath
+
+    New-ItemProperty -Path $RegKeyPath -Name "NoRemove" -Value 1 -PropertyType DWord -Force | Out-Null
+    Write-Output "[SET] NoRemove = 1"
+
+    New-ItemProperty -Path $RegKeyPath -Name "NoModify" -Value 1 -PropertyType DWord -Force | Out-Null
+    Write-Output "[SET] NoModify = 1"
+
+    Write-Output "[DONE] Fleet osquery uninstall options hardened."
+} else {
+    Write-Output "[WARN] Fleet osquery not found. Nothing changed."
+}