diff --git a/cluster/staging/app/dummy/deploy/dummy-nginx.hcl b/cluster/staging/app/dummy/deploy/dummy-nginx.hcl
index cf9ec94..5f3d5f6 100644
--- a/cluster/staging/app/dummy/deploy/dummy-nginx.hcl
+++ b/cluster/staging/app/dummy/deploy/dummy-nginx.hcl
@@ -37,10 +37,12 @@ job "dummy-nginx" {
 
       volume_mount {
         volume      = "nix-store"
+        read_only = true
         destination = "/nix"
       }
       volume_mount {
         volume      = "nix-current-system-bin"
+        read_only = true
         destination = "/run/current-system/sw/bin"
       }