diff --git a/config/nacos/options.go b/config/nacos/options.go
index 5fcb691..4b90c25 100644
--- a/config/nacos/options.go
+++ b/config/nacos/options.go
@@ -2,12 +2,14 @@ package nacos
 
 import (
 	"context"
+	"github.com/dobyte/due/v2/config"
 	"github.com/dobyte/due/v2/etc"
 	"github.com/nacos-group/nacos-sdk-go/v2/clients/config_client"
 	"time"
 )
 
 const (
+	defaultMode        = config.ReadOnly
 	defaultUrl         = "http://127.0.0.1:8848/nacos"
 	defaultClusterName = "DEFAULT"
 	defaultGroupName   = "DEFAULT_GROUP"
@@ -26,6 +28,7 @@ const (
 )
 
 const (
+	defaultModeKey        = "etc.config.nacos.mode"
 	defaultUrlsKey        = "etc.config.nacos.urls"
 	defaultClusterNameKey = "etc.config.nacos.clusterName"
 	defaultGroupNameKey   = "etc.config.nacos.groupName"
@@ -50,6 +53,10 @@ type options struct {
 	// 默认context.Background
 	ctx context.Context
 
+	// 读写模式
+	// 支持read-only、write-only和read-write三种模式，默认为read-only模式
+	mode config.Mode
+
 	// 服务器地址 [scheme://]ip:port[/nacos]
 	// 默认为[]string{http://127.0.0.1:8848/nacos}
 	urls []string
@@ -119,6 +126,7 @@ type options struct {
 func defaultOptions() *options {
 	return &options{
 		ctx:         context.Background(),
+		mode:        config.Mode(etc.Get(defaultModeKey, defaultMode).String()),
 		urls:        etc.Get(defaultUrlsKey, []string{defaultUrl}).Strings(),
 		clusterName: etc.Get(defaultClusterNameKey, defaultClusterName).String(),
 		groupName:   etc.Get(defaultGroupNameKey, defaultGroupName).String(),
@@ -142,6 +150,11 @@ func WithContext(ctx context.Context) Option {
 	return func(o *options) { o.ctx = ctx }
 }
 
+// WithMode 设置读写模式
+func WithMode(mode config.Mode) Option {
+	return func(o *options) { o.mode = mode }
+}
+
 // WithUrls 设置服务器地址
 func WithUrls(urls ...string) Option {
 	return func(o *options) { o.urls = urls }
diff --git a/config/nacos/source.go b/config/nacos/source.go
index e9aedff..8dec3b2 100644
--- a/config/nacos/source.go
+++ b/config/nacos/source.go
@@ -119,6 +119,10 @@ func (s *Source) Store(ctx context.Context, file string, content []byte) error {
 		return s.err
 	}
 
+	if s.opts.mode != config.WriteOnly && s.opts.mode != config.ReadWrite {
+		return errors.ErrNoOperationPermission
+	}
+
 	_, err := s.opts.client.PublishConfig(vo.ConfigParam{
 		DataId:  file,
 		Group:   s.opts.groupName,
diff --git a/testdata/etc/etc.toml b/testdata/etc/etc.toml
index 5c46df4..effdfcc 100644
--- a/testdata/etc/etc.toml
+++ b/testdata/etc/etc.toml
@@ -38,6 +38,40 @@ timezone = "Local"
         path = "config"
         # 读写模式。可选：read-only | write-only | read-write，默认为read-only
         mode = "read-only"
+    # nacos配置中心
+    [config.nacos]
+        # 读写模式。可选：read-only | write-only | read-write，默认为read-only
+        mode = "read-only"
+        # 服务器地址 [scheme://]ip:port[/nacos]。默认为["http://127.0.0.1:8848/nacos"]
+        urls = ["http://127.0.0.1:8848/nacos"]
+        # 集群名称。默认为DEFAULT
+        clusterName = "DEFAULT"
+        # 群组名称。默认为DEFAULT_GROUP
+        groupName = "DEFAULT_GROUP"
+        # 请求Nacos服务端超时时间，支持单位：纳秒（ns）、微秒（us | µs）、毫秒（ms）、秒（s）、分（m）、小时（h）、天（d）。默认为3秒
+        timeout = "3s"
+        # ACM的命名空间Id。默认为空
+        namespaceId = ""
+        # 当使用ACM时，需要该配置，默认为空。详见：https://help.aliyun.com/document_detail/130146.html
+        endpoint = ""
+        # ACM&KMS的regionId，用于配置中心的鉴权。默认为空
+        regionId = ""
+        # ACM&KMS的AccessKey，用于配置中心的鉴权。默认为空
+        accessKey = ""
+        # ACM&KMS的SecretKey，用于配置中心的鉴权。默认为空
+        secretKey = ""
+        # 是否开启kms，同时DataId必须以"cipher-"作为前缀才会启动加解密逻辑。kms可以参考文档：https://help.aliyun.com/product/28933.html
+        openKMS = false
+        # 缓存service信息的目录。默认为./run/nacos/naming/cache
+        cacheDir = "./run/nacos/config/cache"
+        # Nacos服务端的API鉴权Username。默认为空
+        username = ""
+        # Nacos服务端的API鉴权Password。默认为空
+        password = ""
+        # 日志存储路径。默认为./run/nacos/naming/log
+        logDir = "./run/nacos/config/log"
+        # 日志输出级别，可选：debug、info、warn、error。默认为info
+        logLevel = "info"
 
 [cluster]
     # 集群网关配置