diff --git a/samba/CHANGELOG.md b/samba/CHANGELOG.md
index 75fdcd9..e354c14 100644
--- a/samba/CHANGELOG.md
+++ b/samba/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Changelog
 
+## 9.0
+
+- New option `veto_files` to limit writing of specified files to the share
+
 ## 8.3
 
 - Fixes a bug in warning log message, causing start failure
diff --git a/samba/README.md b/samba/README.md
index e5ceec2..d5d5d75 100644
--- a/samba/README.md
+++ b/samba/README.md
@@ -38,6 +38,11 @@ Add-on configuration:
     "10.0.0.0/8",
     "172.16.0.0/12",
     "192.168.0.0/16"
+  ],
+  "veto_files": [
+    "._*",
+    ".DS_Store",
+    "Thumbs.db"
   ]
 }
 ```
@@ -57,7 +62,9 @@ Change WORKGROUP to reflect your network needs.
 
 List of hosts/networks allowed to access your configuration. 
 
+### Option: `veto_files` (optional)
 
+List of files that are neither visible nor accessible. Useful to stop clients from littering the share with temporary hidden files (ex: macOS .DS_Store, Windows Thumbs.db)
 
 ## Known issues and limitations
 
diff --git a/samba/config.json b/samba/config.json
index dae8693..d37e6f5 100644
--- a/samba/config.json
+++ b/samba/config.json
@@ -1,6 +1,6 @@
 {
   "name": "Samba share",
-  "version": "8.3",
+  "version": "9.0",
   "slug": "samba",
   "description": "Expose Hass.io folders with SMB/CIFS",
   "url": "https://home-assistant.io/addons/samba/",
@@ -30,6 +30,13 @@
       "10.0.0.0/8",
       "172.16.0.0/12",
       "192.168.0.0/16"
+    ],
+    "veto_files": [
+      "._*",
+      ".DS_Store",
+      "Thumbs.db",
+      "icon?",
+      ".Trashes"
     ]
   },
   "schema": {
@@ -39,7 +46,10 @@
     "interface": "str",
     "allow_hosts": [
       "str"
+    ],
+    "veto_files": [
+      "str"
     ]
   },
   "image": "homeassistant/{arch}-addon-samba"
-}
\ No newline at end of file
+}
diff --git a/samba/run.sh b/samba/run.sh
index d5da184..248e0af 100755
--- a/samba/run.sh
+++ b/samba/run.sh
@@ -5,6 +5,12 @@ INTERFACE=$(bashio::config 'interface')
 ALLOW_HOSTS=$(bashio::config "allow_hosts | join(\" \")")
 USERNAME=$(bashio::config 'username')
 PASSWORD=$(bashio::config 'password')
+DELETE_VETO_FILES="no"
+VETO_FILES=$(bashio::config "veto_files | join(\"/\")")
+if bashio::config.has_value 'veto_files'; then
+    VETO_FILES="/$VETO_FILES/"
+    DELETE_VETO_FILES="yes"
+fi
 
 WAIT_PIDS=()
 
@@ -27,6 +33,8 @@ sed -i "s|%%NAME%%|${NAME}|g" /etc/smb.conf
 sed -i "s|%%INTERFACE%%|${INTERFACE}|g" /etc/smb.conf
 sed -i "s|%%USERNAME%%|${USERNAME}|g" /etc/smb.conf
 sed -i "s#%%ALLOW_HOSTS%%#${ALLOW_HOSTS}#g" /etc/smb.conf
+sed -i "s|%%VETO_FILES%%|${VETO_FILES}|g" /etc/smb.conf
+sed -i "s|%%DELETE_VETO_FILES%%|${DELETE_VETO_FILES}|g" /etc/smb.conf
 
 # Init users
 addgroup "${USERNAME}"
diff --git a/samba/smb.conf b/samba/smb.conf
index ddb625c..a3f643c 100644
--- a/samba/smb.conf
+++ b/samba/smb.conf
@@ -23,6 +23,8 @@
    valid users = %%USERNAME%%
    force user = root
    force group = root
+   veto files = %%VETO_FILES%%
+   delete veto files = %%DELETE_VETO_FILES%%
 
 [addons]
    browseable = yes
@@ -32,6 +34,8 @@
    valid users = %%USERNAME%%
    force user = root
    force group = root
+   veto files = %%VETO_FILES%%
+   delete veto files = %%DELETE_VETO_FILES%%
 
 [ssl]
    browseable = yes
@@ -41,6 +45,8 @@
    valid users = %%USERNAME%%
    force user = root
    force group = root
+   veto files = %%VETO_FILES%%
+   delete veto files = %%DELETE_VETO_FILES%%
 
 [share]
    browseable = yes
@@ -50,6 +56,8 @@
    valid users = %%USERNAME%%
    force user = root
    force group = root
+   veto files = %%VETO_FILES%%
+   delete veto files = %%DELETE_VETO_FILES%%
 
 [backup]
    browseable = yes
@@ -59,3 +67,5 @@
    valid users = %%USERNAME%%
    force user = root
    force group = root
+   veto files = %%VETO_FILES%%
+   delete veto files = %%DELETE_VETO_FILES%%