diff --git a/.devcontainer/lock.config.php b/.devcontainer/lock.config.php
new file mode 100644
index 0000000000000..f48baeb0e8c79
--- /dev/null
+++ b/.devcontainer/lock.config.php
@@ -0,0 +1,4 @@
+<?php
+$CONFIG = array (
+    'config_is_read_only' => true,
+);
\ No newline at end of file
diff --git a/.devcontainer/nmc.config.php b/.devcontainer/nmc.config.php
index a229873231e62..719958cb9e73d 100644
--- a/.devcontainer/nmc.config.php
+++ b/.devcontainer/nmc.config.php
@@ -3,7 +3,6 @@
     'htaccess.RewriteBase' => '/',
     'default_language' => 'de_DE',
     'integrity.check.disabled' => true, // not recommended for prod, but for customisation
-    // 'config_is_read_only' => true,
     'auth.authtoken.v1.disabled' => true,
     'sharing.force_share_accept' => true,
     'status-email-message-provider' => '\\OCA\\EmailTemplateExample\\MessageProvider',
diff --git a/.devcontainer/nmcsetup.sh b/.devcontainer/nmcsetup.sh
index ba7ee23250d0b..6de50d9413786 100755
--- a/.devcontainer/nmcsetup.sh
+++ b/.devcontainer/nmcsetup.sh
@@ -34,4 +34,10 @@ sudo -u ${APACHE_RUN_USER} php occ config:app:set theming iOSClientUrl --value \
 
 # enable/disable apps
 sudo -u ${APACHE_RUN_USER} php occ app:enable nmctheme
-sudo -u ${APACHE_RUN_USER} php occ app:disable dashboard  # may remove as soon as dashboard CR is implemented
\ No newline at end of file
+sudo -u ${APACHE_RUN_USER} php occ app:disable dashboard  # may remove as soon as dashboard CR is implemented
+
+# there are side effects when using devcontainer and
+# doing the main settings via webapp. For the moment, the best
+# workaround is to lock config and avoid overwrite by nextcloud
+# esp. on container rebuild
+cp .devcontainer/lock.config.php config/lock.config.php