diff --git a/config/services/kubo-local.nix b/config/services/kubo-local.nix
index 591fc325..61346628 100644
--- a/config/services/kubo-local.nix
+++ b/config/services/kubo-local.nix
@@ -64,4 +64,8 @@
   networking.firewall.allowedUDPPorts = [
     4001
   ];
+  fileSystems."/var/lib/ipfs/root" = {
+    device = "/";
+    options = ["bind" "ro"];
+  };
 }