[Unit]
Description=Remount /flash as RO
ConditionKernelCommandLine=fat32-boot
DefaultDependencies=no
After=final.target

[Service]
Type=oneshot
ExecStart=mount -o remount,ro /flash

[Install]
WantedBy=final.target