diff --git a/conf/app.src b/conf/app.src
index bfc90a7..b42c487 100644
--- a/conf/app.src
+++ b/conf/app.src
@@ -1,4 +1,4 @@
-SOURCE_URL=https://github.com/duniter/cesium/releases/download/v1.6.3/cesium-v1.6.3-web.zip
+SOURCE_URL=https://github.com/duniter/cesium/releases/download/v1.6.7/cesium-v1.6.7-web.zip
 SOURCE_SUM=e6bb12bb56453781d01fe0f74afd28990d693010652b542eae0d3348f51d911e
 SOURCE_SUM_PRG=sha256sum
 SOURCE_FORMAT=zip
diff --git a/scripts/install b/scripts/install
index 1702adf..fc527ab 100755
--- a/scripts/install
+++ b/scripts/install
@@ -23,7 +23,7 @@ yunohost app checkurl "${domain}${path}" -a "$app" \
 src_path=/var/www/$app
 mkdir -p $src_path
 	# Download, check integrity, uncompress and patch the source from app.src
-    ynh_script_progression --message="Setting up source files..." --time --weight=1
+  ynh_script_progression --message="Setting up source files..." --time --weight=1
 	ynh_setup_source --dest_dir=$src_path
 chown -R www-data: $src_path
 
@@ -33,10 +33,14 @@ sed -i "s@YNH_WWW_PATH@$path@g" $nginx_conf
 sed -i "s@YNH_WWW_ALIAS@$src_path/@g" $nginx_conf
 cp $nginx_conf /etc/nginx/conf.d/$domain.d/$app.conf
 
+
+
 # If app is public, add url to SSOWat conf as skipped_uris
 if [[ $is_public -eq 1 ]]; then
   # unprotected_uris allows SSO credentials to be passed anyway.
   ynh_app_setting_set "$app" unprotected_uris "/"
+# activate read-only
+ynh_replace_string --match_string='"readonly": false,' --replace_string='"readonly": true,' --target_file="$src_path/config.js"
 fi
 
 # Reload nginx service
diff --git a/scripts/upgrade b/scripts/upgrade
index 79820c9..08c1a9c 100755
--- a/scripts/upgrade
+++ b/scripts/upgrade
@@ -46,6 +46,8 @@ cp $nginx_conf /etc/nginx/conf.d/$domain.d/$app.conf
 # If app is public, add url to SSOWat conf as skipped_uris
 if [[ $is_public -eq 1 ]]; then
   ynh_app_setting_set "$app" unprotected_uris "/"
+#  activate read-only
+ynh_replace_string --match_string='"readonly": false,' --replace_string='"readonly": true,' --target_file="$src_path/config.js"
 fi
 
 # Reload nginx service