diff --git a/internal/distro/fedora/images.go b/internal/distro/fedora/images.go
index 93d086f41..b5724dbee 100644
--- a/internal/distro/fedora/images.go
+++ b/internal/distro/fedora/images.go
@@ -2,8 +2,10 @@ package fedora
 
 import (
 	"math/rand"
+	"strings"
 
 	"github.com/osbuild/osbuild-composer/internal/blueprint"
+	"github.com/osbuild/osbuild-composer/internal/common"
 	"github.com/osbuild/osbuild-composer/internal/distro"
 	"github.com/osbuild/osbuild-composer/internal/image"
 	"github.com/osbuild/osbuild-composer/internal/manifest"
@@ -281,6 +283,12 @@ func iotRawImage(workload workload.Workload,
 	}
 	img := image.NewOSTreeRawImage(commit)
 
+	// Set sysroot read-only only for Fedora 37+
+	distro := t.Arch().Distro()
+	if strings.HasPrefix(distro.Name(), "fedora") && !common.VersionLessThan(distro.Releasever(), "37") {
+		img.SysrootReadOnly = true
+	}
+
 	img.Users = users.UsersFromBP(customizations.GetUsers())
 	img.Groups = users.GroupsFromBP(customizations.GetGroups())
 
diff --git a/test/data/manifests/fedora_35-aarch64-iot_raw_image-boot.json b/test/data/manifests/fedora_35-aarch64-iot_raw_image-boot.json
index db4076980..a6772958c 100644
--- a/test/data/manifests/fedora_35-aarch64-iot_raw_image-boot.json
+++ b/test/data/manifests/fedora_35-aarch64-iot_raw_image-boot.json
@@ -1856,7 +1856,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": true,
+                  "readonly": false,
                   "bootloader": "none"
                 }
               }
diff --git a/test/data/manifests/fedora_35-x86_64-iot_raw_image-boot.json b/test/data/manifests/fedora_35-x86_64-iot_raw_image-boot.json
index bae7fe27e..29aa0e368 100644
--- a/test/data/manifests/fedora_35-x86_64-iot_raw_image-boot.json
+++ b/test/data/manifests/fedora_35-x86_64-iot_raw_image-boot.json
@@ -1880,7 +1880,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": true,
+                  "readonly": false,
                   "bootloader": "none"
                 }
               }
diff --git a/test/data/manifests/fedora_36-aarch64-iot_raw_image-boot.json b/test/data/manifests/fedora_36-aarch64-iot_raw_image-boot.json
index 6f34e467c..31d81c76a 100644
--- a/test/data/manifests/fedora_36-aarch64-iot_raw_image-boot.json
+++ b/test/data/manifests/fedora_36-aarch64-iot_raw_image-boot.json
@@ -2104,7 +2104,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": true,
+                  "readonly": false,
                   "bootloader": "none"
                 }
               }
diff --git a/test/data/manifests/fedora_36-x86_64-iot_raw_image-boot.json b/test/data/manifests/fedora_36-x86_64-iot_raw_image-boot.json
index b2c8241ec..84c09e32d 100644
--- a/test/data/manifests/fedora_36-x86_64-iot_raw_image-boot.json
+++ b/test/data/manifests/fedora_36-x86_64-iot_raw_image-boot.json
@@ -2128,7 +2128,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": true,
+                  "readonly": false,
                   "bootloader": "none"
                 }
               }