diff --git a/templates/master/01-master-kubelet/_base/files/criometricsproxy.yaml b/templates/master/01-master-kubelet/_base/files/criometricsproxy.yaml
index 17ed1ffc8d..bcdf704c09 100644
--- a/templates/master/01-master-kubelet/_base/files/criometricsproxy.yaml
+++ b/templates/master/01-master-kubelet/_base/files/criometricsproxy.yaml
@@ -75,6 +75,8 @@ contents:
         - name: etc-kube
           mountPath: "/etc/kubernetes"
           mountPropagation: HostToContainer
+          readOnly: true
         - name: var-lib-kubelet
           mountPath: "/var/lib/kubelet"
           mountPropagation: HostToContainer
+          readOnly: true
diff --git a/templates/worker/01-worker-kubelet/_base/files/criometricsproxy.yaml b/templates/worker/01-worker-kubelet/_base/files/criometricsproxy.yaml
index 17ed1ffc8d..bcdf704c09 100644
--- a/templates/worker/01-worker-kubelet/_base/files/criometricsproxy.yaml
+++ b/templates/worker/01-worker-kubelet/_base/files/criometricsproxy.yaml
@@ -75,6 +75,8 @@ contents:
         - name: etc-kube
           mountPath: "/etc/kubernetes"
           mountPropagation: HostToContainer
+          readOnly: true
         - name: var-lib-kubelet
           mountPath: "/var/lib/kubelet"
           mountPropagation: HostToContainer
+          readOnly: true