diff --git a/repos/gems/recipes/raw/depot_download/depot_download.config b/repos/gems/recipes/raw/depot_download/depot_download.config
index 26101efb61..80e3fd2851 100644
--- a/repos/gems/recipes/raw/depot_download/depot_download.config
+++ b/repos/gems/recipes/raw/depot_download/depot_download.config
@@ -34,6 +34,28 @@
 		</config>
 	</start>
 
+	<start name="depot_ro">
+		<binary name="chroot"/>
+		<resource name="RAM" quantum="1M" />
+		<provides> <service name="File_system"/> </provides>
+		<config> <default-policy path="/" writeable="no"/> </config>
+		<route>
+			<service name="File_system"> <parent label="depot"/> </service>
+			<any-service> <parent/> </any-service>
+		</route>
+	</start>
+
+	<start name="public_ro">
+		<binary name="chroot"/>
+		<resource name="RAM" quantum="1M" />
+		<provides> <service name="File_system"/> </provides>
+		<config> <default-policy path="/" writeable="no"/> </config>
+		<route>
+			<service name="File_system"> <parent label="public"/> </service>
+			<any-service> <parent/> </any-service>
+		</route>
+	</start>
+
 	<start name="manager">
 		<binary name="depot_download_manager"/>
 		<resource name="RAM" quantum="1M"/>
@@ -54,10 +76,10 @@
 		<route>
 			<service name="ROM" label="config"> <child name="report_rom"/> </service>
 			<service name="Report"> <child name="report_rom"/> </service>
-			<service name="File_system" label="depot">     <parent label="depot"/>     </service>
-			<service name="File_system" label="depot_rw">  <parent label="depot_rw"/>  </service>
-			<service name="File_system" label="public">    <parent label="public"/>    </service>
-			<service name="File_system" label="public_rw"> <parent label="public_rw"/> </service>
+			<service name="File_system" label="depot">     <child name="depot_ro"/>  </service>
+			<service name="File_system" label="depot_rw">  <parent label="depot"/>   </service>
+			<service name="File_system" label="public">    <child name="public_ro"/> </service>
+			<service name="File_system" label="public_rw"> <parent label="public"/>  </service>
 			<any-service> <parent/> <any-child/> </any-service>
 		</route>
 	</start>
diff --git a/repos/gems/run/depot_download.run b/repos/gems/run/depot_download.run
index 5c89642f4d..25786f1fee 100644
--- a/repos/gems/run/depot_download.run
+++ b/repos/gems/run/depot_download.run
@@ -72,10 +72,8 @@ append config {
 				</dir>
 				<dir name="public"> <ram/> </dir>
 			</vfs>
-			<policy label="depot_download -> depot_rw"  root="/depot" writeable="yes"/>
-			<policy label="depot_download -> depot"     root="/depot"/>
-			<policy label="depot_download -> public_rw" root="/public" writeable="yes"/>
-			<policy label="depot_download -> public"    root="/public"/>
+			<policy label="depot_download -> depot"  root="/depot"  writeable="yes"/>
+			<policy label="depot_download -> public" root="/public" writeable="yes"/>
 		</config>
 	</start>
 
diff --git a/repos/gems/run/sculpt.run b/repos/gems/run/sculpt.run
index 05f9a9fa56..76773068f5 100644
--- a/repos/gems/run/sculpt.run
+++ b/repos/gems/run/sculpt.run
@@ -598,14 +598,14 @@ append depot_deploy_config {
 		<route>
 			<service name="File_system"> <parent label="rw"/> </service>
 		</route>
-		<config> <default-policy path="/vm/debian"/> </config>
+		<config> <default-policy path="/vm/debian" writeable="yes"/> </config>
 	</start>
 
 	<start name="shared_fs" pkg="} [depot_user]/pkg/[current_pkg chroot] {">
 		<route>
 			<service name="File_system"> <parent label="rw"/> </service>
 		</route>
-		<config> <default-policy path="/shared"/> </config>
+		<config> <default-policy path="/shared" writeable="yes"/> </config>
 	</start>
 
 	<start name="usb_devices_rom" pkg="} [depot_user]/pkg/[current_pkg rom_filter] {">
diff --git a/repos/gems/run/sculpt/download_runtime.config b/repos/gems/run/sculpt/download_runtime.config
index fb35d76c5b..af22f27dc1 100644
--- a/repos/gems/run/sculpt/download_runtime.config
+++ b/repos/gems/run/sculpt/download_runtime.config
@@ -100,7 +100,7 @@
 		<binary name="chroot"/>
 		<resource name="RAM" quantum="1M" />
 		<provides> <service name="File_system"/> </provides>
-		<config> <default-policy path="/vm/debian"/> </config>
+		<config> <default-policy path="/vm/debian" writeable="yes"/> </config>
 		<route>
 			<service name="File_system"> <child name="fs"/> </service>
 			<any-service> <parent/> </any-service>
diff --git a/repos/gems/run/sculpt/update_runtime.config b/repos/gems/run/sculpt/update_runtime.config
index a59ab36563..94a43cb6d7 100644
--- a/repos/gems/run/sculpt/update_runtime.config
+++ b/repos/gems/run/sculpt/update_runtime.config
@@ -72,7 +72,7 @@
 		<binary name="chroot"/>
 		<resource name="RAM" quantum="1M" />
 		<provides> <service name="File_system"/> </provides>
-		<config> <default-policy path="/depot"/> </config>
+		<config> <default-policy path="/depot" writeable="yes"/> </config>
 		<route>
 			<service name="File_system"> <child name="fs"/> </service>
 			<any-service> <parent/> </any-service>
@@ -83,7 +83,7 @@
 		<binary name="chroot"/>
 		<resource name="RAM" quantum="1M" />
 		<provides> <service name="File_system"/> </provides>
-		<config> <default-policy path="/public"/> </config>
+		<config> <default-policy path="/public" writeable="yes"/> </config>
 		<route>
 			<service name="File_system"> <child name="fs"/> </service>
 			<any-service> <parent/> </any-service>
diff --git a/repos/gems/src/app/depot_download_manager/gen_chroot.cc b/repos/gems/src/app/depot_download_manager/gen_chroot.cc
index c0966e44e7..5dcc2bcbd8 100644
--- a/repos/gems/src/app/depot_download_manager/gen_chroot.cc
+++ b/repos/gems/src/app/depot_download_manager/gen_chroot.cc
@@ -23,7 +23,10 @@ void Depot_download_manager::gen_chroot_start_content(Xml_generator &xml,
 
 	xml.node("config", [&] () {
 		xml.node("default-policy", [&] () {
-			xml.attribute("path", Path("/", user)); }); });
+			xml.attribute("path", Path("/", user));
+			xml.attribute("writeable", "yes");
+		});
+	});
 
 	xml.node("provides", [&] () {
 		xml.node("service", [&] () {