diff --git a/src/nix/modules/service/host-store.nix b/src/nix/modules/service/host-store.nix
index e8fa9ee..63a77c1 100644
--- a/src/nix/modules/service/host-store.nix
+++ b/src/nix/modules/service/host-store.nix
@@ -19,7 +19,7 @@ in
     };
     service.hostStoreAsReadOnly = mkOption {
       type = types.bool;
-      default = false;
+      default = true;
       description = "Adds a ':ro' (read-only) access mode to the host nix store bind mount.";
     };
     service.useHostNixDaemon = mkOption {