diff --git a/hosts/by-name/servo/services/nfs.nix b/hosts/by-name/servo/services/nfs.nix
index e9cd5e6f..80962205 100644
--- a/hosts/by-name/servo/services/nfs.nix
+++ b/hosts/by-name/servo/services/nfs.nix
@@ -56,7 +56,7 @@
   #
   # 10.0.0.0/8 to export (readonly) both to LAN (unencrypted) and wg vpn (encrypted)
   services.nfs.server.exports = ''
-    /var/nfs/export 10.78.79.0/10(crossmnt,fsid=0,subtree_check) 10.0.10.0/24(rw,no_root_squash,crossmnt,fsid=0,subtree_check)
+    /var/nfs/export 10.78.79.0/22(ro,crossmnt,fsid=0,subtree_check) 10.0.10.0/24(rw,no_root_squash,crossmnt,fsid=0,subtree_check)
   '';
 
   fileSystems."/var/nfs/export/media" = {