diff --git a/contrib/systemd/yggdrasil.service.debian b/contrib/systemd/yggdrasil.service.debian
index 0f3c7a8d..51b148dc 100644
--- a/contrib/systemd/yggdrasil.service.debian
+++ b/contrib/systemd/yggdrasil.service.debian
@@ -12,6 +12,7 @@ ProtectSystem=strict
 NoNewPrivileges=true
 RuntimeDirectory=yggdrasil
 ReadWritePaths=/var/run/yggdrasil/ /run/yggdrasil/
+ReadOnlyPaths=/etc/yggdrasil
 SyslogIdentifier=yggdrasil
 CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
 AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
@@ -22,4 +23,4 @@ Restart=always
 TimeoutStopSec=5
 
 [Install]
-WantedBy=multi-user.target
\ No newline at end of file
+WantedBy=multi-user.target