diff --git a/sys/net/ipfw3/ip_fw3_glue.c b/sys/net/ipfw3/ip_fw3_glue.c
--- a/sys/net/ipfw3/ip_fw3_glue.c
+++ b/sys/net/ipfw3/ip_fw3_glue.c
@@ -53,6 +53,15 @@ ip_fw3_sockopt(struct sockopt *sopt)
 
 	ASSERT_NETISR0;
 
+	/*
+	 * Disallow firewall mutations in really-really secure mode, matching
+	 * the gate present in every sibling glue layer (ip_fw2_glue.c,
+	 * ip_dummynet3_glue.c, ip6_fw.c, pf_ioctl.c).  SOPT_GET remains
+	 * allowed, consistent with ip_fw2_glue.c and ip_dummynet3_glue.c.
+	 */
+	if (sopt->sopt_dir == SOPT_SET && securelevel >= 3)
+		return EPERM;
+
 	if (IPFW3_LOADED)
 		error = ip_fw_ctl_x_ptr(sopt);
 	else