diff --git a/nelmio/security-bundle/2.4/config/packages/nelmio_security.yaml b/nelmio/security-bundle/2.4/config/packages/nelmio_security.yaml
new file mode 100644
index 00000000..292bbeb6
--- /dev/null
+++ b/nelmio/security-bundle/2.4/config/packages/nelmio_security.yaml
@@ -0,0 +1,26 @@
+nelmio_security:
+    # prevents framing of the entire site
+    clickjacking:
+        paths:
+            '^/.*': DENY
+
+    # disables content type sniffing for script resources
+    content_type:
+        nosniff: true
+
+    # forces Microsoft's XSS-Protection with
+    # its block mode
+    xss_protection:
+        enabled: true
+        mode_block: true
+
+    # Send a full URL in the `Referer` header when performing a same-origin request,
+    # only send the origin of the document to secure destination (HTTPS->HTTPS),
+    # and send no header to a less secure destination (HTTPS->HTTP).
+    # If `strict-origin-when-cross-origin` is not supported, use `no-referrer` policy,
+    # no referrer information is sent along with requests.
+    referrer_policy:
+        enabled: true
+        policies:
+            - 'no-referrer'
+            - 'strict-origin-when-cross-origin'
diff --git a/nelmio/security-bundle/2.4/manifest.json b/nelmio/security-bundle/2.4/manifest.json
new file mode 100644
index 00000000..c5c97e51
--- /dev/null
+++ b/nelmio/security-bundle/2.4/manifest.json
@@ -0,0 +1,8 @@
+{
+    "bundles": {
+        "Nelmio\\SecurityBundle\\NelmioSecurityBundle": ["all"]
+    },
+    "copy-from-recipe": {
+        "config/": "%CONFIG_DIR%/"
+    }
+}