diff --git a/units/systemd-sysupdated.service.in b/units/systemd-sysupdated.service.in
index 28671fbc54c..ae0adf3d64a 100644
--- a/units/systemd-sysupdated.service.in
+++ b/units/systemd-sysupdated.service.in
@@ -21,7 +21,7 @@ NoNewPrivileges=yes
 MemoryDenyWriteExecute=yes
 ProtectHostname=yes
 RestrictRealtime=yes
-RestrictNamespaces=net
+RestrictNamespaces=net mnt
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
 SystemCallFilter=@system-service @mount
 SystemCallErrorNumber=EPERM