diff --git a/src/main/java/eu/openanalytics/containerproxy/backend/ecs/EcsBackend.java b/src/main/java/eu/openanalytics/containerproxy/backend/ecs/EcsBackend.java
index a3eb0582..5fda9dad 100644
--- a/src/main/java/eu/openanalytics/containerproxy/backend/ecs/EcsBackend.java
+++ b/src/main/java/eu/openanalytics/containerproxy/backend/ecs/EcsBackend.java
@@ -316,7 +316,8 @@ private String getTaskDefinition(Authentication user, ContainerSpec spec, EcsSpe
             .dockerLabels(dockerLabels)
             .logConfiguration(getLogConfiguration(proxy.getSpecId()))
             .mountPoints(volumes.getSecond())
-            .secrets(getSecrets(specExtension));
+            .secrets(getSecrets(specExtension))
+            .readonlyRootFilesystem(true);
 
         String credentials = specExtension.getEcsRepositoryCredentialsParameter().getValueOrDefault(defaultRepositoryCredentialsParameter);
         if (credentials != null && !credentials.isBlank()) {