diff --git a/hosts/iron/services/home-assistant.nix b/hosts/iron/services/home-assistant.nix
index fb520a9..e85e3a7 100644
--- a/hosts/iron/services/home-assistant.nix
+++ b/hosts/iron/services/home-assistant.nix
@@ -231,7 +231,7 @@ in
       after = [ "snapserver.service" ];
       serviceConfig = {
         BindPaths = [ "/run/snapserver/hass.fifo" ];
-        BindReadOnlyPaths = [ "/nix/store" "/etc/ssl/certs" "/etc/static/ssl/certs" ];
+        BindReadOnlyPaths = [ "/nix/store" "/etc/ssl/certs" "/etc/static/ssl/certs" "/bin/sh" ];
         CapabilityBoundingSet = "";
         DynamicUser = "true";
         Group = "snapserver";