diff --git a/shelfmark/config/security.py b/shelfmark/config/security.py
index de0a9c75..8a094fed 100644
--- a/shelfmark/config/security.py
+++ b/shelfmark/config/security.py
@@ -92,7 +92,10 @@ def security_settings() -> list[SettingsField]:
         SelectField(
             key="AUTH_METHOD",
             label="Authentication Method",
-            description="Select the authentication method for accessing Shelfmark.",
+            description=(
+                "Select the authentication method for accessing Shelfmark. "
+                "Restart container after changing Calibre-Web passwords."
+            ),
             options=auth_method_options,
             default="none",
         ),
diff --git a/shelfmark/core/admin_routes.py b/shelfmark/core/admin_routes.py
index b969d00f..16da5e9c 100644
--- a/shelfmark/core/admin_routes.py
+++ b/shelfmark/core/admin_routes.py
@@ -134,7 +134,7 @@ def _sync_all_cwa_users(user_db: UserDB) -> dict[str, int]:
         raise FileNotFoundError(msg)
 
     db_path = os.fspath(CWA_DB_PATH)
-    db_uri = f"file:{db_path}?mode=ro"
+    db_uri = f"file:{db_path}?mode=ro&immutable=1"
     conn = sqlite3.connect(db_uri, uri=True)
     try:
         cur = conn.cursor()
diff --git a/shelfmark/main.py b/shelfmark/main.py
index fc63a354..777fbea2 100644
--- a/shelfmark/main.py
+++ b/shelfmark/main.py
@@ -2091,7 +2091,7 @@ def api_login() -> Response | tuple[Response, int]:
 
             try:
                 db_path = os.fspath(CWA_DB_PATH)
-                db_uri = f"file:{db_path}?mode=ro"
+                db_uri = f"file:{db_path}?mode=ro&immutable=1"
                 conn = sqlite3.connect(db_uri, uri=True)
                 cur = conn.cursor()
                 cur.execute("SELECT password, role, email FROM user WHERE name = ?", (username,))