diff --git a/src/DependencyInjection/Configuration.php b/src/DependencyInjection/Configuration.php
index deacc68..85ce869 100644
--- a/src/DependencyInjection/Configuration.php
+++ b/src/DependencyInjection/Configuration.php
@@ -338,9 +338,9 @@ private function getXssProtectionNode(): ArrayNodeDefinition
         $node->setDeprecated('nelmio/security-bundle', '3.4.0', 'The "%node%" option is deprecated, use Content Security Policy without allowing "unsafe-inline" scripts instead.');
         $node
             ->children()
-                ->booleanNode('enabled')->end()
-                ->booleanNode('mode_block')->end()
-                ->scalarNode('report_uri')->end()
+                ->booleanNode('enabled')->defaultFalse()->end()
+                ->booleanNode('mode_block')->defaultFalse()->end()
+                ->scalarNode('report_uri')->defaultNull()->end()
             ->end();
 
         return $node;