diff --git a/src/basic/blockdev-util.c b/src/basic/blockdev-util.c
index 2f3f1aecc8..676ad9351b 100644
--- a/src/basic/blockdev-util.c
+++ b/src/basic/blockdev-util.c
@@ -68,7 +68,7 @@ int get_block_device(const char *path, dev_t *ret) {
         /* Gets the block device directly backing a file system. If the block device is encrypted, returns
          * the device mapper block device. */
 
-        fd = open(path, O_NOFOLLOW|O_CLOEXEC);
+        fd = open(path, O_RDONLY|O_NOFOLLOW|O_CLOEXEC);
         if (fd < 0)
                 return -errno;