diff --git a/modules/services/misc/nix-daemon.nix b/modules/services/misc/nix-daemon.nix
index a2ec899a593..bdee1095db6 100644
--- a/modules/services/misc/nix-daemon.nix
+++ b/modules/services/misc/nix-daemon.nix
@@ -185,7 +185,7 @@ in
       };
 
       readOnlyStore = mkOption {
-        default = false;
+        default = true;
         description = ''
           If set, NixOS will enforce the immutability of the Nix store
           by making <filename>/nix/store</filename> a read-only bind