diff --git a/hosts/media1/media-desktop.nix b/hosts/media1/media-desktop.nix
index d76b764..cd71bf6 100644
--- a/hosts/media1/media-desktop.nix
+++ b/hosts/media1/media-desktop.nix
@@ -102,6 +102,7 @@ in
 
   # Allow promtail to read kodi logs
   users.users.promtail.extraGroups = [ "kodi" ];
+  systemd.services.promtail.serviceConfig.ProtectHome = lib.mkForce "read-only";
 
   # Packages available on the system
   environment.systemPackages = [