diff --git a/OpenApi.yml b/OpenApi.yml
index df5cc83..d348697 100644
--- a/OpenApi.yml
+++ b/OpenApi.yml
@@ -320,7 +320,7 @@ components:
       properties:
         type:
           type: string
-          enum: [ private, template, public ]
+          enum: [ private, template, protected, public ]
           example: private
         host_path:
           type: string
diff --git a/client/src/api/api.ts b/client/src/api/api.ts
index 196fde8..c64e202 100644
--- a/client/src/api/api.ts
+++ b/client/src/api/api.ts
@@ -337,6 +337,7 @@ export interface RoomMount {
 export enum RoomMountTypeEnum {
     private = 'private',
     template = 'template',
+    protected = 'protected',
     public = 'public'
 }
 
diff --git a/client/src/components/RoomsCreate.vue b/client/src/components/RoomsCreate.vue
index c3ea9d3..712a6ff 100644
--- a/client/src/components/RoomsCreate.vue
+++ b/client/src/components/RoomsCreate.vue
@@ -273,7 +273,8 @@
           <v-row align="center" no-gutters v-if="data.mounts.length > 0">
             <p>
               <strong>Private</strong>: Host path is relative to <code class="mx-1">&lt;storage path&gt;/rooms/&lt;room name&gt;/</code>. <br />
-              <strong>Template</strong>: Host path is relative to <code class="mx-1">&lt;storage path&gt;/templates/</code> and is readonly. <br />
+              <strong>Template</strong>: Host path is relative to <code class="mx-1">&lt;storage path&gt;/templates/</code>, and will be readonly. <br />
+              <strong>Protected</strong>: Host path must be whitelisted in config and exists on the host, will be readonly. <br />
               <strong>Public</strong>: Host path must be whitelisted in config and exists on the host.
             </p>
           </v-row>
@@ -503,6 +504,10 @@ export default class RoomsCreate extends Vue {
         text: 'Template',
         value: 'template',
       },
+      {
+        text: 'Protected',
+        value: 'protected',
+      },
       {
         text: 'Public',
         value: 'public',
diff --git a/docs/storage.png b/docs/storage.png
index c852e28..b41ffb2 100644
Binary files a/docs/storage.png and b/docs/storage.png differ
diff --git a/internal/room/manager.go b/internal/room/manager.go
index 68e840b..33cb5b0 100644
--- a/internal/room/manager.go
+++ b/internal/room/manager.go
@@ -336,7 +336,10 @@ func (manager *RoomManagerCtx) Create(settings types.RoomSettings) (string, erro
 
 			// prefix host path
 			hostPath = path.Join(manager.config.StorageExternal, templateStoragePath, hostPath)
-		} else if mount.Type == types.MountPublic {
+		} else if mount.Type == types.MountProtected || mount.Type == types.MountPublic {
+			// readonly if mount type is protected
+			readOnly = mount.Type == types.MountProtected
+
 			// public whitelisted mounts
 			var isAllowed = false
 			for _, path := range manager.config.MountsWhitelist {
diff --git a/internal/types/room.go b/internal/types/room.go
index a3a5f5a..61e132f 100644
--- a/internal/types/room.go
+++ b/internal/types/room.go
@@ -44,9 +44,10 @@ type RoomEntry struct {
 type MountType string
 
 const (
-	MountPrivate  MountType = "private"
-	MountTemplate MountType = "template"
-	MountPublic   MountType = "public"
+	MountPrivate   MountType = "private"
+	MountTemplate  MountType = "template"
+	MountProtected MountType = "protected"
+	MountPublic    MountType = "public"
 )
 
 type RoomMount struct {