diff --git a/metropolis/node/kubernetes/csi.go b/metropolis/node/kubernetes/csi.go
index f7ff00a..c4e793d 100644
--- a/metropolis/node/kubernetes/csi.go
+++ b/metropolis/node/kubernetes/csi.go
@@ -115,7 +115,7 @@
 			return nil, status.Errorf(codes.Unavailable, "failed to bind-mount volume: %v", err)
 		}
 
-		var flags uintptr = unix.MS_REMOUNT | unix.MS_BIND
+		var flags uintptr = unix.MS_REMOUNT | unix.MS_BIND | unix.MS_NOEXEC | unix.MS_NOSUID | unix.MS_NODEV
 		if req.Readonly {
 			flags |= unix.MS_RDONLY
 		}