diff --git a/apparmor.d/groups/systemd/journalctl b/apparmor.d/groups/systemd/journalctl
index df637757c..acc28048c 100644
--- a/apparmor.d/groups/systemd/journalctl
+++ b/apparmor.d/groups/systemd/journalctl
@@ -34,7 +34,7 @@ profile journalctl @{exec_path} flags=(attach_disconnected) {
   /var/lib/systemd/catalog/.#database* rw,
 
         /{run,var}/log/journal/ r,
-        /{run,var}/log/journal/@{md5}/ rw,
+        /{run,var}/log/journal/@{md5}/ r,
         /{run,var}/log/journal/@{md5}/system.journal* r,
         /{run,var}/log/journal/@{md5}/system@@{hex}.journal* rw,
         /{run,var}/log/journal/@{md5}/user-@{hex}.journal* rw,