diff --git a/bib/cmd/bootc-image-builder/main.go b/bib/cmd/bootc-image-builder/main.go
index 6db227c1a..2e68d3626 100644
--- a/bib/cmd/bootc-image-builder/main.go
+++ b/bib/cmd/bootc-image-builder/main.go
@@ -237,7 +237,7 @@ func cmdBuild(cmd *cobra.Command, args []string) error {
 	if err := setup.Validate(); err != nil {
 		return err
 	}
-	if err := setup.EnsureEnvironment(); err != nil {
+	if err := setup.EnsureEnvironment(osbuildStore); err != nil {
 		return err
 	}
 
diff --git a/bib/internal/setup/setup.go b/bib/internal/setup/setup.go
index 944a64d0c..be97ae74d 100644
--- a/bib/internal/setup/setup.go
+++ b/bib/internal/setup/setup.go
@@ -12,13 +12,21 @@ import (
 
 // EnsureEnvironment mutates external filesystem state as necessary
 // to run in a container environment.  This function is idempotent.
-func EnsureEnvironment() error {
+func EnsureEnvironment(storePath string) error {
 	osbuildPath := "/usr/bin/osbuild"
 	if util.IsMountpoint(osbuildPath) {
 		return nil
 	}
 
-	// A hardcoded security label from Fedora derivatives
+	// Forcibly label the store to ensure we're not grabbing container labels
+	rootType := "system_u:object_r:root_t:s0"
+	// This papers over the lack of ensuring correct labels for the /ostree root
+	// in the existing pipeline
+	if err := util.RunCmdSync("chcon", rootType, storePath); err != nil {
+		return err
+	}
+
+	// A hardcoded security label from Fedora derivatives for osbuild
 	// TODO: Avoid hardcoding this by using either host policy lookup
 	// Or eventually depend on privileged containers just having this capability.
 	//
@@ -53,6 +61,7 @@ func EnsureEnvironment() error {
 	if err := util.RunCmdSync("mount", "--bind", destPath, osbuildPath); err != nil {
 		return err
 	}
+
 	return nil
 }