diff --git a/.gitea/workflows/test.yaml b/.gitea/workflows/test.yaml
index 0d8764e..e65d6d5 100644
--- a/.gitea/workflows/test.yaml
+++ b/.gitea/workflows/test.yaml
@@ -15,13 +15,13 @@ jobs:
         SSH_AUTH_SOCK: /tmp/ssh.sock
         ENVIRONMENT: dev
       volumes:
-        - ${{ vars.BUILDER_VOLUME_HOME }}/.ssh/known_hosts:/root/.ssh/known_hosts
-        - ${{ env.SSH_AUTH_SOCK }}:/tmp/ssh.sock
-        - /etc/gitconfig:/etc/gitconfig
-        - ${{ vars.BUILDER_VOLUME_HOME }}/.gitconfig:/root/.gitconfig
-        - ${{ vars.BUILDER_VOLUME_HOME }}/.git-credentials:/root/.git-credentials
-        - /etc/ssl/certs:/etc/ssl/certs
-        - ${{ vars.GITEA_WORKSPACE }}:/go/src
+        - "${{ vars.BUILDER_VOLUME_HOME }}/.ssh/known_hosts:/root/.ssh/known_hosts"
+        - "${{ env.SSH_AUTH_SOCK }}:/tmp/ssh.sock"
+        - "/etc/gitconfig:/etc/gitconfig:ro"
+        - "${{ vars.BUILDER_VOLUME_HOME }}/.gitconfig:/root/.gitconfig:ro"
+        - "${{ vars.BUILDER_VOLUME_HOME }}/.git-credentials:/root/.git-credentials:ro"
+        - "/etc/ssl/certs:/etc/ssl/certs:ro"
+        - "${{ vars.GITEA_WORKSPACE }}:/go/src"
       options: --cpus 1
     steps:
       - run: apk add --no-cache nodejs