diff --git a/nixos/github-runner.nix b/nixos/github-runner.nix
index 9a845a3..6673588 100644
--- a/nixos/github-runner.nix
+++ b/nixos/github-runner.nix
@@ -53,6 +53,7 @@ in
           sopsPrefix = lib.mkOption {
             type = types.str;
             default = "gh-selfhosted-tokens";
+            readOnly = true;
           };
           nixosConfig = lib.mkOption {
             type = types.deferredModule;