diff --git a/nixosModules/eko.nix b/nixosModules/eko.nix
index 222d90b..5515bc7 100644
--- a/nixosModules/eko.nix
+++ b/nixosModules/eko.nix
@@ -49,6 +49,7 @@
         ProtectKernelTunables = true;
         ProtectProc = "invisible";
         ProtectSystem = "strict";
+        ReadWritePaths = [ "/srv/eko" ];
         RestrictAddressFamilies = [
           "AF_INET"
           "AF_INET6"