diff --git a/rust/Makefile b/rust/Makefile
index 07686cb9..93d1f738 100644
--- a/rust/Makefile
+++ b/rust/Makefile
@@ -114,9 +114,10 @@ ifneq ($(HAVE_DRACUT),0)
 	$(INSTALL) -m 755 pvebc/$(SEL_EBC_MODDIR)/module-setup.sh \
 		pvebc/$(SEL_EBC_MODDIR)/override-crypttab.sh \
 		pvebc/$(SEL_EBC_MODDIR)/pvebc-wrapper.sh \
+		pvebc/$(SEL_EBC_MODDIR)/boot-mount.sh \
 		pvebc/$(SEL_EBC_MODDIR)/sel-ebc-modules.conf \
 		$(DESTDIR)$(DRACUTMODDIR)/$(SEL_EBC_MODDIR)
-	$(INSTALL) -m 644 pvebc/$(SEL_EBC_MODDIR)/boot.mount \
+	$(INSTALL) -m 644 pvebc/$(SEL_EBC_MODDIR)/sel-ebc-boot-mount.service \
 		pvebc/$(SEL_EBC_MODDIR)/sel-ebc-override-crypttab.service \
 		pvebc/$(SEL_EBC_MODDIR)/sel-ebc-paes-enforce.service \
 		pvebc/$(SEL_EBC_MODDIR)/sel-ebc-pvebc.service \
diff --git a/rust/pvebc/95sel-ebc/boot-mount.sh b/rust/pvebc/95sel-ebc/boot-mount.sh
new file mode 100644
index 00000000..adc8bdb8
--- /dev/null
+++ b/rust/pvebc/95sel-ebc/boot-mount.sh
@@ -0,0 +1,31 @@
+#!/bin/bash
+# SPDX-License-Identifier: MIT
+#
+# Copyright IBM Corp.
+
+set -eu
+
+mntp="/boot"
+block_dev="$(blkid -L boot)"
+
+if [[ -z "${block_dev}" ]]; then
+	echo "Unable to find partition with label boot"
+	exit 1
+elif [[ ! -b "${block_dev}" ]]; then
+	echo "Unable to find block device ${block_dev}"
+	exit 1
+else
+	echo "Found block device ${block_dev}"
+fi
+
+if [[ ! -d "${mntp}" ]]; then
+	echo "Mountpoint ${mntp} does not exist, creating..."
+	mkdir "${mntp}"
+else
+	echo "Mountpoint ${mntp} exists"
+fi
+
+echo "Mounting ${block_dev} to ${mntp}"
+mount --options ro "${block_dev}" "${mntp}"
+
+exit 0
diff --git a/rust/pvebc/95sel-ebc/boot.mount b/rust/pvebc/95sel-ebc/boot.mount
deleted file mode 100644
index b672bcd6..00000000
--- a/rust/pvebc/95sel-ebc/boot.mount
+++ /dev/null
@@ -1,28 +0,0 @@
-[Unit]
-Description=Mount /boot early in initramfs
-
-# Initramfs requirement
-DefaultDependencies=no
-# Make absolutely sure this only runs in initramfs (and not post-pivot if the
-# unit ever appears there)
-ConditionPathExists=/etc/initrd-release
-ConditionKernelCommandLine=root
-
-# we use /dev/disk/by-label because it identifies the boot partition system
-# independently IF set up correctly
-Requires=dev-disk-by\x2dlabel-boot.device
-
-# Ordering dependencies
-After=dev-disk-by\x2dlabel-boot.device
-Before=sel-ebc-pvebc.service
-
-[Mount]
-# system independent identification of boot partition requires that the label
-# boot is set for the boot partition
-What=/dev/disk/by-label/boot
-Where=/boot
-Type=auto
-Options=defaults
-
-[Install]
-WantedBy=sel-ebc-pvebc.service
diff --git a/rust/pvebc/95sel-ebc/module-setup.sh b/rust/pvebc/95sel-ebc/module-setup.sh
index d804f6fd..8ada0473 100644
--- a/rust/pvebc/95sel-ebc/module-setup.sh
+++ b/rust/pvebc/95sel-ebc/module-setup.sh
@@ -43,8 +43,8 @@ install() {
 		"$systemdsystemunitdir/sel-ebc-paes-enforce.service"
 	inst_simple "$moddir/sel-ebc-override-crypttab.service" \
 		"$systemdsystemunitdir/sel-ebc-override-crypttab.service"
-	inst_simple "$moddir/boot.mount" \
-		"$systemdsystemunitdir/boot.mount"
+	inst_simple "$moddir/sel-ebc-boot-mount.service" \
+		"$systemdsystemunitdir/sel-ebc-boot-mount.service"
 
 	# already exisitng unit we depend on for kernel modules
 	inst_simple /usr/lib/systemd/system/systemd-modules-load.service \
@@ -58,6 +58,10 @@ install() {
 	inst_simple "$moddir/override-crypttab.sh" \
 		"/etc/sel-ebc/override-crypttab.sh"
 
+	# mount boot partition to /boot
+	inst_simple "$moddir/boot-mount.sh" \
+		"/etc/sel-ebc/boot-mount.sh"
+
 	# install kernel module dependencies
 	inst_simple "$moddir/sel-ebc-modules.conf" \
 		"/usr/lib/modules-load.d/sel-ebc-modules.conf"
@@ -76,5 +80,5 @@ install() {
 	systemctl --root "$initdir" --no-reload --quiet enable sel-ebc-override-crypttab.service
 	systemctl --root "$initdir" --no-reload --quiet enable sel-ebc-paes-enforce.service
 	systemctl --root "$initdir" --no-reload --quiet enable systemd-modules-load.service
-	systemctl --root "$initdir" --no-reload --quiet enable boot.mount
+	systemctl --root "$initdir" --no-reload --quiet enable sel-ebc-boot-mount.service
 }
diff --git a/rust/pvebc/95sel-ebc/override-crypttab.sh b/rust/pvebc/95sel-ebc/override-crypttab.sh
index fb17498a..78b7d79b 100644
--- a/rust/pvebc/95sel-ebc/override-crypttab.sh
+++ b/rust/pvebc/95sel-ebc/override-crypttab.sh
@@ -15,6 +15,11 @@ cp "${IBM_RSRC_DIR}/crypttab" "/etc/crypttab"
 
 systemctl daemon-reload
 
-systemctl restart systemd-cryptsetup@cryptroot_mapper.service
+udevadm trigger --subsystem-match=block --settle
+
+if ! systemctl restart systemd-cryptsetup@cryptroot_mapper.service; then
+        systemctl status systemd-cryptsetup@cryptroot_mapper.service
+        exit 1
+fi
 
 exit 0
diff --git a/rust/pvebc/95sel-ebc/sel-ebc-boot-mount.service b/rust/pvebc/95sel-ebc/sel-ebc-boot-mount.service
new file mode 100644
index 00000000..8316d129
--- /dev/null
+++ b/rust/pvebc/95sel-ebc/sel-ebc-boot-mount.service
@@ -0,0 +1,21 @@
+[Unit]
+Description=Mount a partition identified by label boot to /boot
+
+# Ensure this runs before the handoff to the real root, if that's required:
+Before=sel-ebc-pvebc.service
+
+# Initramfs requirement
+DefaultDependencies=no
+# Make absolutely sure this only runs in initramfs
+ConditionPathExists=/etc/initrd-release
+ConditionKernelCommandLine=rd.sel-ebc
+
+[Service]
+Type=oneshot
+ExecStart=/bin/bash /etc/sel-ebc/boot-mount.sh
+RemainAfterExit=yes
+# On failure immediately abort boot
+FailureAction=poweroff-immediate
+
+[Install]
+RequiredBy=sel-ebc-pvebc.service
diff --git a/rust/pvebc/95sel-ebc/sel-ebc-override-crypttab.service b/rust/pvebc/95sel-ebc/sel-ebc-override-crypttab.service
index ee03a19f..7d30fee7 100644
--- a/rust/pvebc/95sel-ebc/sel-ebc-override-crypttab.service
+++ b/rust/pvebc/95sel-ebc/sel-ebc-override-crypttab.service
@@ -4,10 +4,8 @@ Description=Override crypttab
 # boot partition contains SICS
 # Loading of kernel modules is required which are needed for protected keys
 Requires=systemd-modules-load.service
-Requires=boot.mount
 
 # Ensure this runs before the handoff to the real root, if that's required:
-After=boot.mount
 After=systemd-modules-load.service
 Before=cryptsetup-pre.target
 Before=cryptsetup.target
diff --git a/rust/pvebc/95sel-ebc/sel-ebc-pvebc.service b/rust/pvebc/95sel-ebc/sel-ebc-pvebc.service
index 70dff16e..13652621 100644
--- a/rust/pvebc/95sel-ebc/sel-ebc-pvebc.service
+++ b/rust/pvebc/95sel-ebc/sel-ebc-pvebc.service
@@ -4,14 +4,14 @@ Description=Run pvebc during early boot to process SICS
 # boot partition contains SICS
 # Loading of kernel modules is required which are needed for protected keys
 Requires=systemd-modules-load.service
-Wants=boot.mount
+Requires=sel-ebc-boot-mount.service
 
 # Ensure this runs before the handoff to the real root, if that's required:
 Before=initrd-root-device.target
 Before=cryptsetup-pre.target
 Before=cryptsetup.target
-After=boot.mount
 After=systemd-modules-load.service
+After=sel-ebc-boot-mount.service
 
 # Initramfs requirement
 DefaultDependencies=no