diff --git a/proxy/create_container_interceptor.go b/proxy/create_container_interceptor.go
index 574b5c01..ee5c43ed 100644
--- a/proxy/create_container_interceptor.go
+++ b/proxy/create_container_interceptor.go
@@ -53,7 +53,7 @@ func (i *createContainerInterceptor) InterceptRequest(r *http.Request) error {
 		if container.HostConfig == nil {
 			container.HostConfig = &docker.HostConfig{}
 		}
-		container.HostConfig.VolumesFrom = append(container.HostConfig.VolumesFrom, "weaveproxy")
+		container.HostConfig.VolumesFrom = append(container.HostConfig.VolumesFrom, "weaveproxy:ro")
 		if container.Config == nil {
 			container.Config = &docker.Config{}
 		}
diff --git a/test/610_proxy_wait_for_weave_test.sh b/test/610_proxy_wait_for_weave_test.sh
index 204f86cc..ddc63b3d 100755
--- a/test/610_proxy_wait_for_weave_test.sh
+++ b/test/610_proxy_wait_for_weave_test.sh
@@ -25,4 +25,7 @@ assert "entrypoint c2" "$(entrypoint $COMMITTED_IMAGE)"
 docker_on $HOST1 run -dit --name c3 $SMALL_IMAGE /bin/sh
 assert_raises "proxy docker_on $HOST1 exec c3 true"
 
+# Check we can't modify weavewait
+assert_raises "proxy docker_on $HOST1 run -e 'WEAVE_CIDR=10.2.1.2/24' $BASE_IMAGE touch /w/w" 1
+
 end_suite