diff --git a/bootc-base-imagectl b/bootc-base-imagectl
index 51884f2..80d5307 100755
--- a/bootc-base-imagectl
+++ b/bootc-base-imagectl
@@ -4,6 +4,7 @@ import os
 import os.path as path
 import subprocess
 import shutil
+import stat
 import json
 import argparse
 import sys
@@ -30,6 +31,11 @@ def run_build_rootfs(args):
         rpmostree_argv.extend([f'/{MANIFESTDIR}/{manifest_path}', target])
         # Perform the build
         subprocess.run(rpmostree_argv, check=True)
+        # Work around https://github.com/coreos/rpm-ostree/pull/5322
+        root_mode = os.lstat(target).st_mode
+        if (root_mode & stat.S_IXOTH) == 0:
+            print("Updating rootfs mode")
+            os.chmod(target, root_mode | (0o555))
         # And run the bootc linter for good measure
         subprocess.run([
             'bootc',
diff --git a/tests/rootfs/cases/root-mode b/tests/rootfs/cases/root-mode
new file mode 100755
index 0000000..475f3ef
--- /dev/null
+++ b/tests/rootfs/cases/root-mode
@@ -0,0 +1,4 @@
+#!/bin/bash
+set -xeuo pipefail
+# Verify we didn't lose the executable bit for others on /
+test $(($(stat -c '0%a' .) % 2)) = 1