diff --git a/Dockerfile b/Dockerfile
index 43c7e49a..f2da3bba 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -23,7 +23,8 @@ ENV DEBIAN_FRONTEND="noninteractive" \
   PLEX_MEDIA_SERVER_MAX_PLUGIN_PROCS="6" \
   PLEX_MEDIA_SERVER_USER="abc" \
   PLEX_MEDIA_SERVER_INFO_VENDOR="Docker" \
-  PLEX_MEDIA_SERVER_INFO_DEVICE="Docker Container (LinuxServer.io)"
+  PLEX_MEDIA_SERVER_INFO_DEVICE="Docker Container (LinuxServer.io)" \
+  TMPDIR=/run/plex-temp
 
 RUN \
   echo "**** install runtime packages ****" && \
diff --git a/Dockerfile.aarch64 b/Dockerfile.aarch64
index 257ca96e..b1c14c69 100644
--- a/Dockerfile.aarch64
+++ b/Dockerfile.aarch64
@@ -20,7 +20,8 @@ ENV DEBIAN_FRONTEND="noninteractive" \
   PLEX_MEDIA_SERVER_MAX_PLUGIN_PROCS="6" \
   PLEX_MEDIA_SERVER_USER="abc" \
   PLEX_MEDIA_SERVER_INFO_VENDOR="Docker" \
-  PLEX_MEDIA_SERVER_INFO_DEVICE="Docker Container (LinuxServer.io)"
+  PLEX_MEDIA_SERVER_INFO_DEVICE="Docker Container (LinuxServer.io)" \
+  TMPDIR=/run/plex-temp
 
 RUN \
   echo "**** install runtime packages ****" && \
diff --git a/README.md b/README.md
index f16b362a..669254e3 100644
--- a/README.md
+++ b/README.md
@@ -77,6 +77,15 @@ Valid settings for VERSION are:-
 + **`public`**: will update plexpass users to the latest public version, useful for plexpass users that don't want to be on the bleeding edge but still want the latest public updates.
 + **`<specific-version>`**: will select a specific version (eg 0.9.12.4.1192-9a47d21) of plex to install, note you cannot use this to access plexpass versions if you do not have plexpass.
 
+## Read-Only Operation
+
+This image can be run with a read-only container filesystem. For details please [read the docs](https://docs.linuxserver.io/misc/read-only/).
+
+### Caveats
+
+* Runtime update of Plex (and thus Plexpass builds) is not supported.
+* Transcode directory must be mounted to a host path or tmpfs.
+
 ### Hardware Acceleration
 
 Many desktop applications need access to a GPU to function properly and even some Desktop Environments have compositor effects that will not function without a GPU. However this is not a hard requirement and all base images will function without a video device mounted into the container.
@@ -161,6 +170,7 @@ Containers are configured using parameters passed at runtime (such as those abov
 | `-v /config` | Plex library location. *This can grow very large, 50gb+ is likely for a large collection.* |
 | `-v /tv` | Media goes here. Add as many as needed e.g. `/movies`, `/tv`, etc. |
 | `-v /movies` | Media goes here. Add as many as needed e.g. `/movies`, `/tv`, etc. |
+| `--read-only=true` | Run container with a read-only filesystem. Please [read the docs](https://docs.linuxserver.io/misc/read-only/). |
 
 ## Environment variables from files (Docker secrets)
 
diff --git a/readme-vars.yml b/readme-vars.yml
index 43f14de5..94007db4 100644
--- a/readme-vars.yml
+++ b/readme-vars.yml
@@ -72,6 +72,12 @@ app_setup_block: |
   + **`<specific-version>`**: will select a specific version (eg 0.9.12.4.1192-9a47d21) of plex to install, note you cannot use this to access plexpass versions if you do not have plexpass.
 
 readme_hwaccel: true
+
+readonly_supported: true
+readonly_message: |
+  * Runtime update of Plex (and thus Plexpass builds) is not supported.
+  * Transcode directory must be mounted to a host path or tmpfs.
+
 # changelog
 changelogs:
   - {date: "18.07.24:", desc: "Rebase to Ubuntu Noble."}
diff --git a/root/etc/s6-overlay/s6-rc.d/init-plex-chown/run b/root/etc/s6-overlay/s6-rc.d/init-plex-chown/run
index 2e979594..6c2d74c8 100755
--- a/root/etc/s6-overlay/s6-rc.d/init-plex-chown/run
+++ b/root/etc/s6-overlay/s6-rc.d/init-plex-chown/run
@@ -1,6 +1,8 @@
 #!/usr/bin/with-contenv bash
 # shellcheck shell=bash
 
+mkdir -p /run/plex-temp
+
 # create folders
 if [[ ! -d "${PLEX_MEDIA_SERVER_APPLICATION_SUPPORT_DIR}" ]]; then
     mkdir -p "${PLEX_MEDIA_SERVER_APPLICATION_SUPPORT_DIR}"
@@ -35,5 +37,6 @@ fi
 
 # permissions (non-recursive) on config root and folders
 lsiown abc:abc \
+    /run/plex-temp \
     /config \
     /config/*
diff --git a/root/etc/s6-overlay/s6-rc.d/init-plex-update/run b/root/etc/s6-overlay/s6-rc.d/init-plex-update/run
index 33b9968c..75ac8252 100755
--- a/root/etc/s6-overlay/s6-rc.d/init-plex-update/run
+++ b/root/etc/s6-overlay/s6-rc.d/init-plex-update/run
@@ -1,6 +1,11 @@
 #!/usr/bin/with-contenv bash
 # shellcheck shell=bash
 
+if [[ -z ${LSIO_READ_ONLY_FS} ]] || [[ -z ${LSIO_NON_ROOT_USER} ]]; then
+    echo "Runtime update not supported with read-only or non-root operation, skipping."
+    exit 0
+fi
+
 # If docker manages versioning exit
 if [[ -n "${VERSION}" ]] && [[ "${VERSION}" == "docker" ]]; then
     echo "Docker is used for versioning skip update check"