diff --git a/compiler/value.go b/compiler/value.go
index 50aed583..db917504 100644
--- a/compiler/value.go
+++ b/compiler/value.go
@@ -138,6 +138,11 @@ func (v *Value) Int64() (int64, error) {
 	return v.val.Int64()
 }
 
+// Proxy function to the underlying cue.Value
+func (v *Value) Bool() (bool, error) {
+	return v.val.Bool()
+}
+
 // Proxy function to the underlying cue.Value
 func (v *Value) Path() cue.Path {
 	return v.val.Path()
diff --git a/plan/task/exec.go b/plan/task/exec.go
index ab573f4d..e529b526 100644
--- a/plan/task/exec.go
+++ b/plan/task/exec.go
@@ -191,7 +191,7 @@ func (t *execTask) mountCache(_ *plancontext.Context, dest string, mnt *compiler
 		return nil, err
 	}
 
-	concurrency, err := mnt.Lookup("concurrency").String()
+	concurrency, err := contents.Lookup("concurrency").String()
 	if err != nil {
 		return nil, err
 	}
@@ -236,13 +236,15 @@ func (t *execTask) mountFS(pctx *plancontext.Context, dest string, mnt *compiler
 		mo = append(mo, llb.SourcePath(src))
 	}
 
-	// FIXME: handle readonly
-	// if readonly := mnt.Lookup("ro"); readonly.Exists() {
-	// 	ro, err := readonly.Cue().Bool()
-	// 	if err != nil {
-	// 		return nil, err
-	// 	}
-	// }
+	if ro := mnt.Lookup("ro"); ro.Exists() {
+		readonly, err := ro.Bool()
+		if err != nil {
+			return nil, err
+		}
+		if readonly {
+			mo = append(mo, llb.Readonly)
+		}
+	}
 
 	st, err := contents.Result().ToState()
 	if err != nil {
diff --git a/tests/tasks/exec/mount_fs.cue b/tests/tasks/exec/mount_fs.cue
index 37d6d4dc..26896971 100644
--- a/tests/tasks/exec/mount_fs.cue
+++ b/tests/tasks/exec/mount_fs.cue
@@ -30,6 +30,40 @@ engine.#Plan & {
 				"sh", "-c",
 				#"""
 					test "$(cat /target/output.txt)" = "hello world"
+					touch /target/rw
+					"""#,
+			]
+		}
+
+		verifyRO: engine.#Exec & {
+			input: image.output
+			mounts: fs: {
+				dest:     "/target"
+				contents: exec.output
+				ro:       true
+			}
+			args: [
+				"sh", "-c",
+				#"""
+					test "$(cat /target/output.txt)" = "hello world"
+
+					touch /target/ro && exit 1
+					true
+					"""#,
+			]
+		}
+
+		verifySource: engine.#Exec & {
+			input: image.output
+			mounts: fs: {
+				dest:     "/target.txt"
+				contents: exec.output
+				source:   "/output.txt"
+			}
+			args: [
+				"sh", "-c",
+				#"""
+					test "$(cat /target.txt)" = "hello world"
 					"""#,
 			]
 		}