diff --git a/compose.yml b/compose.yml
index cd80e74..d9a740e 100644
--- a/compose.yml
+++ b/compose.yml
@@ -13,7 +13,11 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - /sys:/sys:ro
       - /var/lib/docker:/var/lib/docker:ro
-      - "${CONTAINERD_SOCKET:-/run/containerd/containerd.sock}:/run/containerd/containerd.sock"
+      # long-form avoids toolshed/abra#900
+      - type: bind
+        source: "${CONTAINERD_SOCKET:-/run/containerd/containerd.sock}"
+        target: /run/containerd/containerd.sock
+        read_only: true
       - alloy-data:/var/lib/alloy/data
     # runs through a shell so ALLOY_HTTP_LISTEN_ADDR (set by
     # compose.alloy-webui.yml) is resolved from the container's own