diff --git a/pkg/sentry/devices/tpuproxy/BUILD b/pkg/sentry/devices/tpuproxy/BUILD
index feb362719..8e6698ba3 100644
--- a/pkg/sentry/devices/tpuproxy/BUILD
+++ b/pkg/sentry/devices/tpuproxy/BUILD
@@ -8,13 +8,19 @@ go_library(
     name = "tpuproxy",
     srcs = [
         "device.go",
+        "seccomp_filter.go",
         "tpu.go",
     ],
+    visibility = [
+        "//pkg/sentry:internal",
+    ],
     deps = [
+        "//pkg/abi/linux",
         "//pkg/context",
         "//pkg/devutil",
         "//pkg/errors/linuxerr",
         "//pkg/log",
+        "//pkg/seccomp",
         "//pkg/sentry/arch",
         "//pkg/sentry/vfs",
         "//pkg/sync",
diff --git a/pkg/sentry/devices/tpuproxy/seccomp_filter.go b/pkg/sentry/devices/tpuproxy/seccomp_filter.go
new file mode 100644
index 000000000..f35ddeedf
--- /dev/null
+++ b/pkg/sentry/devices/tpuproxy/seccomp_filter.go
@@ -0,0 +1,56 @@
+// Copyright 2023 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//	http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package tpuproxy
+
+import (
+	"golang.org/x/sys/unix"
+	"gvisor.dev/gvisor/pkg/abi/linux"
+	"gvisor.dev/gvisor/pkg/seccomp"
+)
+
+// Filters returns seccomp-bpf filters for this package.
+func Filters() seccomp.SyscallRules {
+	return seccomp.MakeSyscallRules(map[uintptr]seccomp.SyscallRule{
+		unix.SYS_OPENAT: seccomp.PerArg{
+			// All paths that we openat() are absolute, so we pass a dirfd
+			// of -1 (which is invalid for relative paths, but ignored for
+			// absolute paths) to hedge against bugs involving AT_FDCWD or
+			// real dirfds.
+			seccomp.EqualTo(^uintptr(0)),
+			seccomp.AnyValue{},
+			seccomp.MaskedEqual(unix.O_CREAT|unix.O_NOFOLLOW, unix.O_NOFOLLOW),
+			seccomp.AnyValue{},
+		},
+		unix.SYS_GETDENTS64: seccomp.MatchAll{},
+		unix.SYS_EVENTFD2: seccomp.Or{
+			seccomp.PerArg{
+				seccomp.AnyValue{},
+				seccomp.EqualTo(linux.EFD_NONBLOCK),
+			},
+			seccomp.PerArg{
+				seccomp.AnyValue{},
+				seccomp.EqualTo(linux.EFD_NONBLOCK | linux.EFD_SEMAPHORE),
+			},
+		},
+		unix.SYS_MREMAP: seccomp.PerArg{
+			seccomp.AnyValue{},
+			seccomp.EqualTo(0), /* old_size */
+			seccomp.AnyValue{},
+			seccomp.EqualTo(linux.MREMAP_MAYMOVE | linux.MREMAP_FIXED),
+			seccomp.AnyValue{},
+			seccomp.EqualTo(0),
+		},
+	})
+}
diff --git a/runsc/boot/filter/config/BUILD b/runsc/boot/filter/config/BUILD
index ee0d4be16..3a8013dd3 100644
--- a/runsc/boot/filter/config/BUILD
+++ b/runsc/boot/filter/config/BUILD
@@ -32,6 +32,7 @@ go_library(
         "//pkg/seccomp/precompiledseccomp",
         "//pkg/sentry/devices/accel",
         "//pkg/sentry/devices/nvproxy",
+        "//pkg/sentry/devices/tpuproxy",
         "//pkg/sentry/platform",
         "//pkg/sentry/platform/kvm",
         "//pkg/sentry/platform/systrap",
diff --git a/runsc/boot/filter/config/config.go b/runsc/boot/filter/config/config.go
index e52b66d7b..10dc0f6c0 100644
--- a/runsc/boot/filter/config/config.go
+++ b/runsc/boot/filter/config/config.go
@@ -27,6 +27,7 @@ import (
 	"gvisor.dev/gvisor/pkg/seccomp/precompiledseccomp"
 	"gvisor.dev/gvisor/pkg/sentry/devices/accel"
 	"gvisor.dev/gvisor/pkg/sentry/devices/nvproxy"
+	"gvisor.dev/gvisor/pkg/sentry/devices/tpuproxy"
 	"gvisor.dev/gvisor/pkg/sentry/platform"
 )
 
@@ -140,6 +141,7 @@ func rules(opt Options, vars precompiledseccomp.Values) (seccomp.SyscallRules, s
 	}
 	if opt.TPUProxy {
 		s.Merge(accel.Filters())
+		s.Merge(tpuproxy.Filters())
 	}
 
 	s.Merge(opt.Platform.SyscallFilters(vars))