diff --git a/ansible/plays/common.yaml b/ansible/plays/common.yaml
index 7dfa617..3c6b47b 100644
--- a/ansible/plays/common.yaml
+++ b/ansible/plays/common.yaml
@@ -122,7 +122,7 @@
         path: /etc/ssh/authorized_keys/backup
         state: present
         search_string: "{{ keypair.public_key }}"
-        line: 'command="borg serve --restrict-to-repository {{ repo_path }}",restrict {{ keypair.public_key }}'
+        line: 'command="borg serve --append-only --restrict-to-repository {{ repo_path }}",restrict {{ keypair.public_key }}'
     - name: Add Known Hosts entries
       ansible.builtin.known_hosts:
         path: "/root/.ssh/known_hosts"