diff --git a/dfs/scratch.go b/dfs/scratch.go
index 354096f5..7ba93acb 100644
--- a/dfs/scratch.go
+++ b/dfs/scratch.go
@@ -38,7 +38,7 @@ var (
 		{"none", "/sys/fs/cgroup", "tmpfs", ""},
 	}
 	optionalMounts = [][]string{
-		{"none", "/sys/fs/selinux", "selinuxfs", ""},
+		{"none", "/sys/fs/selinux", "selinuxfs", "ro"},
 	}
 )