diff --git a/docker-compose.prod.yaml b/docker-compose.prod.yaml
index 709c8b58..80842b21 100644
--- a/docker-compose.prod.yaml
+++ b/docker-compose.prod.yaml
@@ -7,12 +7,12 @@ services:
     image: busybox:1.36
     command: [ /bin/sh, -c, 'tail -n+1 -F /var/log/apache2/access.log' ]
     volumes:
-      - legacybackend-logs:/var/log/
+      - legacybackend-logs:/var/log/:ro
   backend-v1-errorlogs:
     image: busybox:1.36
     command: [ /bin/sh, -c, 'tail -n+1 -F /var/log/apache2/error.log' ]
     volumes:
-      - legacybackend-logs:/var/log/
+      - legacybackend-logs:/var/log/:ro
   backend-v1:
     image: ghcr.io/kordianbruck/tca-backend/tca-server:latest
     restart: always
diff --git a/docker-compose.yaml b/docker-compose.yaml
index e7002a5e..882676d7 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -23,8 +23,9 @@ services:
       - SMTP_PORT=${SMTP_PORT:-587}
     volumes:
       - backend-storage:/Storage
-      - ./apns_auth_key.p8:${APNS_P8_FILE_PATH}
+      - ./apns_auth_key.p8:${APNS_P8_FILE_PATH}:ro
     user: 1000:3000
+    read_only: true
     depends_on:
       db:
         condition: service_healthy