diff --git a/usr/lib/archboot/installer/common.sh b/usr/lib/archboot/installer/common.sh
index 6ce22f95c..9a1e49098 100644
--- a/usr/lib/archboot/installer/common.sh
+++ b/usr/lib/archboot/installer/common.sh
@@ -64,7 +64,9 @@ _chroot_mount()
         [[ -e "${_DESTDIR}/dev" ]] || mkdir -m 755 "${_DESTDIR}/dev"
         mount proc "${_DESTDIR}/proc" -t proc -o nosuid,noexec,nodev
         mount sys "${_DESTDIR}/sys" -t sysfs -o nosuid,noexec,nodev,ro
-        mount | grep -qw efivarfs && mount efivarfs ${_DESTDIR}/sys/firmware/efi/efivarfs
+        if mount | grep -qw efivarfs; then
+            mount efivarfs -t efivarfs ${_DESTDIR}/sys/firmware/efi/efivarfs -o nosuid,noexec,nodev
+        fi
         mount udev "${_DESTDIR}/dev" -t devtmpfs -o mode=0755,nosuid
         mount devpts "${_DESTDIR}/dev/pts" -t devpts -o mode=0620,gid=5,nosuid,noexec
         mount shm "${_DESTDIR}/dev/shm" -t tmpfs -o mode=1777,nosuid,nodev