diff --git a/roles/distgit/tasks/main.yml b/roles/distgit/tasks/main.yml
index 064b4ca264..3e37d1b530 100644
--- a/roles/distgit/tasks/main.yml
+++ b/roles/distgit/tasks/main.yml
@@ -35,6 +35,9 @@
 - name: allow httpd to access git user content
   seboolean: name=httpd_read_user_content state=yes persistent=yes
 
+- name: Secure tmpfs read only
+  mount: name=/dev/shm src=tmpfs fstype=tmpfs opts=defaults,size=40G state=present
+
 # -- Dist Git --------------------------------------------
 # This is the Git setup itself: group, root directory, scripts,...
 - name: create the distgit root directory (/srv/git)