diff --git a/kube/deploy/apps/nextcloud/app/hr.yaml b/kube/deploy/apps/nextcloud/app/hr.yaml
index c536da76..49698eab 100644
--- a/kube/deploy/apps/nextcloud/app/hr.yaml
+++ b/kube/deploy/apps/nextcloud/app/hr.yaml
@@ -300,6 +300,7 @@ spec:
           config.php: |-
             <?php
             $CONFIG = array (
+              'config_is_read_only' => true,
               'instanceid' => getenv('NC_INSTANCEID'),
               'passwordsalt' => getenv('NC_PASSWORDSALT'),
               'secret' => getenv('NC_SECRET'),