diff --git a/mounts/org.osbuild.ostree.deployment b/mounts/org.osbuild.ostree.deployment
index 70fcc6eb..5571cc1f 100755
--- a/mounts/org.osbuild.ostree.deployment
+++ b/mounts/org.osbuild.ostree.deployment
@@ -63,6 +63,7 @@ class OSTreeDeploymentMount(mounts.MountService):
     def __init__(self, args):
         super().__init__(args)
 
+        self.tree = None
         self.mountpoint = None
         self.check = False
 
@@ -71,6 +72,7 @@ class OSTreeDeploymentMount(mounts.MountService):
         subprocess.run([
             "mount", "--bind", "--make-private", source, target,
         ], check=True)
+        return target
 
     def mount(self, args: Dict):
 
@@ -82,6 +84,13 @@ class OSTreeDeploymentMount(mounts.MountService):
         ref = deployment["ref"]
         serial = deployment.get("serial", 0)
 
+        # create a private mountpoint for the tree, which is needed
+        # in order to be able to move the `root` mountpoint, which
+        # is contained inside tree, since "moving a mount residing
+        # under a shared mount is invalid and unsupported."
+        #                                              - `mount(8)`
+        self.tree = self.bind_mount(tree, tree)
+
         root = ostree.deployment_path(tree, osname, ref, serial)
 
         print(f"Deployment root at '{os.path.relpath(root, tree)}'")
@@ -104,16 +113,18 @@ class OSTreeDeploymentMount(mounts.MountService):
         self.check = True
 
     def umount(self):
+        if self.mountpoint:
+            subprocess.run(["sync", "-f", self.mountpoint],
+                           check=self.check)
 
-        if not self.mountpoint:
-            return
+            subprocess.run(["umount", "-R", self.mountpoint],
+                           check=self.check)
+            self.mountpoint = None
 
-        subprocess.run(["sync", "-f", self.mountpoint],
-                       check=self.check)
-
-        subprocess.run(["umount", "-R", self.mountpoint],
-                       check=self.check)
-        self.mountpoint = None
+        if self.tree:
+            subprocess.run(["umount", "-R", self.tree],
+                           check=self.check)
+            self.tree = None
 
 
 def main():