diff --git a/metropolis/node/kubernetes/csi.go b/metropolis/node/kubernetes/csi.go
index 40d54d0..f7ff00a 100644
--- a/metropolis/node/kubernetes/csi.go
+++ b/metropolis/node/kubernetes/csi.go
@@ -107,12 +107,7 @@
 			return nil, status.Errorf(codes.Internal, "unable to create requested target path: %v", err)
 		}
 
-		var mountFlags uintptr = unix.MS_BIND
-		if req.Readonly {
-			mountFlags |= unix.MS_RDONLY
-		}
-
-		err := unix.Mount(volumePath, req.TargetPath, "", mountFlags, "")
+		err := unix.Mount(volumePath, req.TargetPath, "", unix.MS_BIND, "")
 		switch {
 		case errors.Is(err, unix.ENOENT):
 			return nil, status.Error(codes.NotFound, "volume not found")
@@ -120,48 +115,13 @@
 			return nil, status.Errorf(codes.Unavailable, "failed to bind-mount volume: %v", err)
 		}
 
-		flagSet := make(map[string]bool)
-		for _, flag := range req.VolumeCapability.GetMount().GetMountFlags() {
-			flagSet[flag] = true
+		var flags uintptr = unix.MS_REMOUNT | unix.MS_BIND
+		if req.Readonly {
+			flags |= unix.MS_RDONLY
 		}
-
-		flagPairs := map[string]string{
-			"exec": "noexec",
-			"dev":  "nodev",
-			"suid": "nosuid",
-		}
-		for pFlag, nFlag := range flagPairs {
-			if flagSet[pFlag] && flagSet[nFlag] {
-				return nil, status.Errorf(codes.InvalidArgument, "contradictory flag pair found. can't have both %q and %q set", pFlag, nFlag)
-			} else if !flagSet[pFlag] && !flagSet[nFlag] {
-				// If neither of a flag pair is found, add the negative flag as default.
-				flagSet[nFlag] = true
-			}
-		}
-
-		var mountAttr unix.MountAttr
-		for flag := range flagSet {
-			switch flag {
-			case "exec":
-				mountAttr.Attr_clr |= unix.MOUNT_ATTR_NOEXEC
-			case "noexec":
-				mountAttr.Attr_set |= unix.MOUNT_ATTR_NOEXEC
-			case "dev":
-				mountAttr.Attr_clr |= unix.MOUNT_ATTR_NODEV
-			case "nodev":
-				mountAttr.Attr_set |= unix.MOUNT_ATTR_NODEV
-			case "suid":
-				mountAttr.Attr_clr |= unix.MOUNT_ATTR_NOSUID
-			case "nosuid":
-				mountAttr.Attr_set |= unix.MOUNT_ATTR_NOSUID
-			default:
-				return nil, status.Errorf(codes.InvalidArgument, "unknown mount flag: %s", flag)
-			}
-		}
-
-		if err := unix.MountSetattr(-1, req.TargetPath, 0, &mountAttr); err != nil {
+		if err := unix.Mount("", req.TargetPath, "", flags, ""); err != nil {
 			_ = unix.Unmount(req.TargetPath, 0) // Best-effort
-			return nil, status.Errorf(codes.Internal, "unable to set mount attributes: %v", err)
+			return nil, status.Errorf(codes.Internal, "unable to set mount-point flags: %v", err)
 		}
 	case *csi.VolumeCapability_Block:
 		f, err := os.OpenFile(volumePath, os.O_RDWR, 0)
diff --git a/metropolis/node/kubernetes/provisioner.go b/metropolis/node/kubernetes/provisioner.go
index 0c5f972..aacb949 100644
--- a/metropolis/node/kubernetes/provisioner.go
+++ b/metropolis/node/kubernetes/provisioner.go
@@ -283,7 +283,6 @@
 
 	volumeID := "pvc-" + string(pvc.ObjectMeta.UID)
 	volumePath := p.volumePath(volumeID)
-	var mountOptions []string
 
 	p.logger.Infof("Creating local PV %s", volumeID)
 
@@ -302,7 +301,6 @@
 		if err := fsquota.SetQuota(volumePath, uint64(capacity), uint64(capacity)/inodeCapacityRatio); err != nil {
 			return fmt.Errorf("failed to update quota: %w", err)
 		}
-		mountOptions = storageClass.MountOptions
 	case v1.PersistentVolumeBlock:
 		imageFile, err := os.OpenFile(volumePath, os.O_CREATE|os.O_RDWR, 0644)
 		if err != nil {
@@ -351,7 +349,6 @@
 				},
 			},
 			StorageClassName:              *pvc.Spec.StorageClassName,
-			MountOptions:                  mountOptions,
 			PersistentVolumeReclaimPolicy: *storageClass.ReclaimPolicy,
 		},
 	}
diff --git a/metropolis/node/kubernetes/reconciler/resources_storageclass.go b/metropolis/node/kubernetes/reconciler/resources_storageclass.go
index 36dee1c..9be81fb 100644
--- a/metropolis/node/kubernetes/reconciler/resources_storageclass.go
+++ b/metropolis/node/kubernetes/reconciler/resources_storageclass.go
@@ -68,8 +68,7 @@
 					"storageclass.kubernetes.io/is-default-class": "true",
 					"kubernetes.io/description": "local is the default storage class on Metropolis. " +
 						"It stores data on the node root disk and supports space limits, resizing and oversubscription but no snapshots. " +
-						"It is backed by XFS and uses permissive mounting options (exec,dev,suid). " +
-						"If you want more strict mounting options, chose the `local-strict` storage class.",
+						"It is backed by XFS.",
 				},
 			},
 			AllowVolumeExpansion: True(),
@@ -82,25 +81,5 @@
 				"suid",
 			},
 		},
-		&storage.StorageClass{
-			ObjectMeta: meta.ObjectMeta{
-				Name:   "local-strict",
-				Labels: builtinLabels(nil),
-				Annotations: map[string]string{
-					"storageclass.kubernetes.io/is-default-class": "false",
-					"kubernetes.io/description": "local-strict is the same as local (see its description) but uses strict mount options (noexec, nodev, nosuid). " +
-						"It is best used together with readOnlyRoot to restrict exploitation vectors.",
-				},
-			},
-			AllowVolumeExpansion: True(),
-			Provisioner:          csiProvisionerName,
-			ReclaimPolicy:        &reclaimPolicyDelete,
-			VolumeBindingMode:    &waitForConsumerBinding,
-			MountOptions: []string{
-				"noexec",
-				"nodev",
-				"nosuid",
-			},
-		},
 	}
 }