diff --git a/nixos/modules/services/monitoring/incron.nix b/nixos/modules/services/monitoring/incron.nix
index 8e312c65f93c..5eec4b82fa02 100644
--- a/nixos/modules/services/monitoring/incron.nix
+++ b/nixos/modules/services/monitoring/incron.nix
@@ -51,7 +51,11 @@ in
 
     security.wrappers.incrontab.source = "${pkgs.incron}/bin/incrontab";
 
-    environment.etc."incron.d/system".text = "${cfg.systab}";
+    # incron won't read symlinks
+    environment.etc."incron.d/system" = {
+      mode = "0444";
+      text = "${cfg.systab}";
+    };
     environment.etc."incron.allow" = mkIf (cfg.allow != null) {
       text = "${concatStringsSep "\n" cfg.allow}";
     };