One option is once permissions are restricted, you then use the Office 365 Update Item action which can use different credentials (an account which does have edit rights to the list item) to updates the list.

Thanks for the suggestion Warwick.  In this case the List is CreditorJustificationV2, so I assume the field will be CreditorJustificationV2, with a field type of Workflow status.  But I now get an error on field/type/content and workflow gets suspended.  So what/how do I specify the field and value for the Update Item / "Field To Update"?

Here's the help page link for that action - Office 365 update items

There is a section in the action for the fields you want to update on the item, just need to match up the field type

The problem seems to be that the action Update Workflow Status updates a number of fields including both the workflow and the status field (field with List name) on the list item.  When changing the list item to read-only to stop the user modifying the item after it has been submitted, the Update Workflow Status breaks when trying to update the list item field as it has no permission to do so given the workflow runs under the initiator's credentials.  I can manually update the item status field using the Office 365 Update Item, selecting the field, type of URL, and updating with text, but that doesn't change the workflow status.

At this point I'm seriously considering having a do the following:

1. change permissions on item to read-only
2. get item approved by manager
3. change permissions allow submitter edit
4. update workflow status
5. change permissions deny submitter edit

but that's an ugly.  I'm sure I'm not the only one who needs to:

1. change permissions on item to read-only
2. get item approved by manager
3. update workflow status

Put that one in an App Step and it should work

Doing that change permissions will probably take about an hour in Office 365, the Nintex actions to set permissions are horribly slow and can take up to 30mins to complete a simple change permissions.

That was the solution, thanks! I'd missed that function when scouring all the actions previously. So now it's

1. change permissions on item to read-only
2. get item approved by manager
3. Inside App Step function [update workflow status]

Hello, 

I am using on-prem Nintex 2013 and need to make item read-only after submit.  can column value be still be set and approved by manager?