diff --git a/doc/ncdu.pod b/doc/ncdu.pod
index f75223225938a9d2a755384f7ca1c5690d6fedec..861271a4c06f27e9aad1d4ccca68664c1943013d 100644
--- a/doc/ncdu.pod
+++ b/doc/ncdu.pod
@@ -35,8 +35,8 @@ I<FILE> is equivalent to C<->, the file is read from standard input.
 
 For the sake of preventing a screw-up, the current version of ncdu will assume
 that the directory information in the imported file does not represent the
-filesystem on which the file is being imported. That is, the refresh and file
-deletion options in the browser will be disabled.
+filesystem on which the file is being imported. That is, the refresh, file
+deletion and shell spawning options in the browser will be disabled.
 
 =item I<dir>
 
@@ -97,6 +97,16 @@ option has no effect when C<-o> is used, because there will not be a browser
 interface in that case. It has no effect when C<-f> is used, either, because
 the deletion feature is disabled in that case anyway.
 
+WARNING: This option will only prevent deletion through the file browser. It is
+still possible to spawn a shell from ncdu and delete or modify files from
+there. To disable that feature as well, pass the C<-r> option twice (see
+C<-rr>).
+
+=item -rr
+
+In addition to C<-r>, this will also disable the shell spawning feature of the
+file browser.
+
 =item --si
 
 List sizes using base 10 prefixes, that is, powers of 1000 (KB, MB, etc), as
diff --git a/src/browser.c b/src/browser.c
index e26683bd95a32e74f5bc4afb8d8e7e485103b98d..38a8afc29c5b6b0a4b0c4231b8b5e5814d1a77e2 100644
--- a/src/browser.c
+++ b/src/browser.c
@@ -417,8 +417,8 @@ int browse_key(int ch) {
       info_show = 0;
       break;
     case 'd':
-      if(read_only || dir_import_active) {
-        message = read_only
+      if(read_only >= 1 || dir_import_active) {
+        message = read_only >= 1
           ? "File deletion disabled in read-only mode."
           : "File deletion not available for imported directories.";
         break;
@@ -432,8 +432,10 @@ int browse_key(int ch) {
       delete_init(sel, t);
       break;
      case 'b':
-      if(dir_import_active) {
-        message = "Shell feature not available for imported directories.";
+      if(read_only >= 2 || dir_import_active) {
+        message = read_only >= 2
+          ? "Shell feature disabled in read-only mode."
+          : "Shell feature not available for imported directories.";
         break;
       }
       shell_init();
diff --git a/src/global.h b/src/global.h
index e2c0b7629f97ae179cae6d6c518e1af962c05357..4cd02e1a40a6a023ae23c160090fc93ccb3373fb 100644
--- a/src/global.h
+++ b/src/global.h
@@ -84,7 +84,7 @@ struct dir {
 
 /* program state */
 extern int pstate;
-/* read-only flag */
+/* read-only flag, 1+ = disable deletion, 2+ = also disable shell */
 extern int read_only;
 /* minimum screen update interval when calculating, in ms */
 extern long update_delay;
diff --git a/src/main.c b/src/main.c
index a5ad2f6157663fe0de5caf5cedc67bfa08c57b6f..7d361cc9f2d73522a9040dce5b5c0d37757c335b 100644
--- a/src/main.c
+++ b/src/main.c
@@ -162,7 +162,7 @@ static void argv_parse(int argc, char **argv) {
       printf("ncdu %s\n", PACKAGE_VERSION);
       exit(0);
     case 'x': dir_scan_smfs = 1; break;
-    case 'r': read_only = 1; break;
+    case 'r': read_only++; break;
     case 's': si = 1; break;
     case 'o': export = val; break;
     case 'f': import = val; break;