diff --git a/conf/cf-lex.l b/conf/cf-lex.l
index d1cc4ed9..04a6c994 100644
--- a/conf/cf-lex.l
+++ b/conf/cf-lex.l
@@ -570,6 +570,9 @@ static inline void cf_swap_soft_scope(struct config *conf);
 static struct symbol *
 cf_new_symbol(struct sym_scope *scope, pool *p, struct linpool *lp, const byte *c)
 {
+  if (scope->readonly)
+    cf_error("Unknown symbol %s", c);
+
   struct symbol *s;
 
   uint l = strlen(c);
@@ -723,6 +726,8 @@ cf_lex_init(int is_cli, struct config *c)
       sym->class = SYM_KEYWORD;
       sym->keyword = k;
     }
+
+    global_root_scope->readonly = 1;
   }
 
   ifs_head = ifs = push_ifs(NULL);
diff --git a/conf/conf.h b/conf/conf.h
index ec8c97e8..8558fcba 100644
--- a/conf/conf.h
+++ b/conf/conf.h
@@ -137,9 +137,10 @@ struct sym_scope {
   HASH(struct symbol) hash;		/* Local symbol hash */
 
   uint slots;				/* Variable slots */
-  byte active;				/* Currently entered */
-  byte block;				/* No independent stack frame */
   byte soft_scopes;			/* Number of soft scopes above */
+  byte active:1;			/* Currently entered */
+  byte block:1;				/* No independent stack frame */
+  byte readonly:1;			/* Do not add new symbols */
 };
 
 extern struct sym_scope *global_root_scope;