diff --git a/metropolis/node/kubernetes/csi.go b/metropolis/node/kubernetes/csi.go
index 5ca6885..eb43ec0 100644
--- a/metropolis/node/kubernetes/csi.go
+++ b/metropolis/node/kubernetes/csi.go
@@ -142,17 +142,17 @@
 		for flag := range flagSet {
 			switch flag {
 			case "exec":
-				mountAttr.Attr_clr = unix.MOUNT_ATTR_NOEXEC
+				mountAttr.Attr_clr |= unix.MOUNT_ATTR_NOEXEC
 			case "noexec":
-				mountAttr.Attr_set = unix.MOUNT_ATTR_NOEXEC
+				mountAttr.Attr_set |= unix.MOUNT_ATTR_NOEXEC
 			case "dev":
-				mountAttr.Attr_clr = unix.MOUNT_ATTR_NODEV
+				mountAttr.Attr_clr |= unix.MOUNT_ATTR_NODEV
 			case "nodev":
-				mountAttr.Attr_set = unix.MOUNT_ATTR_NODEV
+				mountAttr.Attr_set |= unix.MOUNT_ATTR_NODEV
 			case "suid":
-				mountAttr.Attr_clr = unix.MOUNT_ATTR_NOSUID
+				mountAttr.Attr_clr |= unix.MOUNT_ATTR_NOSUID
 			case "nosuid":
-				mountAttr.Attr_set = unix.MOUNT_ATTR_NOSUID
+				mountAttr.Attr_set |= unix.MOUNT_ATTR_NOSUID
 			default:
 				return nil, status.Errorf(codes.InvalidArgument, "unknown mount flag: %s", flag)
 			}