diff --git a/src/libstore/sqlite.cc b/src/libstore/sqlite.cc
index 8159744b7..4166cc2cd 100644
--- a/src/libstore/sqlite.cc
+++ b/src/libstore/sqlite.cc
@@ -1,6 +1,7 @@
 #include "sqlite.hh"
 #include "globals.hh"
 #include "util.hh"
+#include "url.hh"
 
 #include <sqlite3.h>
 
@@ -52,14 +53,16 @@ static void traceSQL(void * x, const char * sql)
 
 SQLite::SQLite(const Path & path, SQLiteOpenMode mode)
 {
+    bool readOnly = mode == SQLiteOpenMode::ReadOnly;
+
     // useSQLiteWAL also indicates what virtual file system we need.  Using
     // `unix-dotfile` is needed on NFS file systems and on Windows' Subsystem
     // for Linux (WSL) where useSQLiteWAL should be false by default.
     const char *vfs = settings.useSQLiteWAL ? 0 : "unix-dotfile";
-    int flags = mode == SQLiteOpenMode::ReadOnly
-        ? SQLITE_OPEN_READONLY : SQLITE_OPEN_READWRITE;
+    int flags = readOnly ? SQLITE_OPEN_READONLY : SQLITE_OPEN_READWRITE;
     if (mode == SQLiteOpenMode::Normal) flags |= SQLITE_OPEN_CREATE;
-    int ret = sqlite3_open_v2(path.c_str(), &db, flags, vfs);
+    auto uri = "file:" + percentEncode(path) + "?immutable=" + (readOnly ? "1" : "0");
+    int ret = sqlite3_open_v2(uri.c_str(), &db, SQLITE_OPEN_URI | flags, vfs);
     if (ret != SQLITE_OK) {
         const char * err = sqlite3_errstr(ret);
         throw Error("cannot open SQLite database '%s': %s", path, err);