diff --git a/pkgs/tools/networking/cloudflare-warp/default.nix b/pkgs/tools/networking/cloudflare-warp/default.nix
index 4a0f84207136..0f6207a53e75 100644
--- a/pkgs/tools/networking/cloudflare-warp/default.nix
+++ b/pkgs/tools/networking/cloudflare-warp/default.nix
@@ -73,6 +73,12 @@ stdenv.mkDerivation rec {
     substituteInPlace $out/lib/systemd/user/warp-taskbar.service \
       --replace "ExecStart=" "ExecStart=$out"
 
+    cat >>$out/lib/systemd/user/warp-taskbar.service <<EOF
+
+    [Service]
+    BindReadOnlyPaths=$out:/usr:
+    EOF
+
     runHook postInstall
   '';