diff --git a/app/src/main/java/com/topjohnwu/magisk/core/Config.kt b/app/src/main/java/com/topjohnwu/magisk/core/Config.kt
index b801658ef..b9d57bbda 100644
--- a/app/src/main/java/com/topjohnwu/magisk/core/Config.kt
+++ b/app/src/main/java/com/topjohnwu/magisk/core/Config.kt
@@ -114,7 +114,6 @@ object Config : PreferenceConfig, DBConfig {
 
     @JvmField var keepVerity = false
     @JvmField var keepEnc = false
-    @JvmField var patchVbmeta = false
     @JvmField var recovery = false
 
     var bootId by preference(Key.BOOT_ID, "")
diff --git a/app/src/main/java/com/topjohnwu/magisk/core/Info.kt b/app/src/main/java/com/topjohnwu/magisk/core/Info.kt
index 270e0780f..c74dbd7e2 100644
--- a/app/src/main/java/com/topjohnwu/magisk/core/Info.kt
+++ b/app/src/main/java/com/topjohnwu/magisk/core/Info.kt
@@ -32,7 +32,7 @@ object Info {
     @JvmField val isZygiskEnabled = System.getenv("ZYGISK_ENABLED") == "1"
     @JvmStatic val isFDE get() = crypto == "block"
     @JvmField var ramdisk = false
-    @JvmField var vbmeta = false
+    var patchBootVbmeta = false
     var crypto = ""
     var noDataExec = false
     var isRooted = false
diff --git a/app/src/main/java/com/topjohnwu/magisk/core/tasks/MagiskInstaller.kt b/app/src/main/java/com/topjohnwu/magisk/core/tasks/MagiskInstaller.kt
index c1b1c1d86..3f6872b7f 100644
--- a/app/src/main/java/com/topjohnwu/magisk/core/tasks/MagiskInstaller.kt
+++ b/app/src/main/java/com/topjohnwu/magisk/core/tasks/MagiskInstaller.kt
@@ -490,7 +490,7 @@ abstract class MagiskInstallImpl protected constructor(
             "cd $installDir",
             "KEEPFORCEENCRYPT=${Config.keepEnc} " +
             "KEEPVERITY=${Config.keepVerity} " +
-            "PATCHVBMETAFLAG=${Config.patchVbmeta} " +
+            "PATCHVBMETAFLAG=${Info.patchBootVbmeta} " +
             "RECOVERYMODE=${Config.recovery} " +
             "LEGACYSAR=${Info.legacySAR} " +
             "sh boot_patch.sh $srcBoot")
diff --git a/app/src/main/java/com/topjohnwu/magisk/core/utils/ShellInit.kt b/app/src/main/java/com/topjohnwu/magisk/core/utils/ShellInit.kt
index 0eb724959..383b08b9c 100644
--- a/app/src/main/java/com/topjohnwu/magisk/core/utils/ShellInit.kt
+++ b/app/src/main/java/com/topjohnwu/magisk/core/utils/ShellInit.kt
@@ -73,18 +73,17 @@ class ShellInit : Shell.Initializer() {
         fun getVar(name: String) = fastCmd("echo \$$name")
         fun getBool(name: String) = getVar(name).toBoolean()
 
-        Info.isSAR = getBool("SYSTEM_ROOT")
+        Info.isSAR = getBool("SYSTEM_AS_ROOT")
         Info.ramdisk = getBool("RAMDISKEXIST")
-        Info.vbmeta = getBool("VBMETAEXIST")
         Info.isAB = getBool("ISAB")
         Info.crypto = getVar("CRYPTOTYPE")
+        Info.patchBootVbmeta = getBool("PATCHVBMETAFLAG")
         Info.legacySAR = getBool("LEGACYSAR")
 
         // Default presets
         Config.recovery = getBool("RECOVERYMODE")
         Config.keepVerity = getBool("KEEPVERITY")
         Config.keepEnc = getBool("KEEPFORCEENCRYPT")
-        Config.patchVbmeta = getBool("PATCHVBMETAFLAG")
 
         return true
     }
diff --git a/app/src/main/java/com/topjohnwu/magisk/ui/install/InstallViewModel.kt b/app/src/main/java/com/topjohnwu/magisk/ui/install/InstallViewModel.kt
index d134bb71e..2f91d1327 100644
--- a/app/src/main/java/com/topjohnwu/magisk/ui/install/InstallViewModel.kt
+++ b/app/src/main/java/com/topjohnwu/magisk/ui/install/InstallViewModel.kt
@@ -104,7 +104,6 @@ class InstallViewModel(svc: NetworkService, markwon: Markwon) : BaseViewModel()
             step,
             Config.keepVerity,
             Config.keepEnc,
-            Config.patchVbmeta,
             Config.recovery
         ))
     }
@@ -115,7 +114,6 @@ class InstallViewModel(svc: NetworkService, markwon: Markwon) : BaseViewModel()
             step = it.step
             Config.keepVerity = it.keepVerity
             Config.keepEnc = it.keepEnc
-            Config.patchVbmeta = it.patchVbmeta
             Config.recovery = it.recovery
         }
     }
@@ -136,7 +134,6 @@ class InstallViewModel(svc: NetworkService, markwon: Markwon) : BaseViewModel()
         val step: Int,
         val keepVerity: Boolean,
         val keepEnc: Boolean,
-        val patchVbmeta: Boolean,
         val recovery: Boolean,
     ) : Parcelable
 
diff --git a/app/src/main/res/raw/manager.sh b/app/src/main/res/raw/manager.sh
index 828a1b05c..a59ef4fe6 100644
--- a/app/src/main/res/raw/manager.sh
+++ b/app/src/main/res/raw/manager.sh
@@ -193,27 +193,29 @@ check_encryption() {
 mount_partitions() {
   [ "$(getprop ro.build.ab_update)" = "true" ] && SLOT=$(getprop ro.boot.slot_suffix)
   # Check whether non rootfs root dir exists
-  SYSTEM_ROOT=false
-  grep ' / ' /proc/mounts | grep -qv 'rootfs' && SYSTEM_ROOT=true
+  SYSTEM_AS_ROOT=false
+  grep ' / ' /proc/mounts | grep -qv 'rootfs' && SYSTEM_AS_ROOT=true
 }
 
 get_flags() {
-  KEEPVERITY=$SYSTEM_ROOT
+  KEEPVERITY=$SYSTEM_AS_ROOT
   ISENCRYPTED=false
   [ "$(getprop ro.crypto.state)" = "encrypted" ] && ISENCRYPTED=true
   KEEPFORCEENCRYPT=$ISENCRYPTED
-  VBMETAEXIST=false
   if [ -n "$(getprop ro.boot.vbmeta.device)" -o -n "$(getprop ro.boot.vbmeta.size)" ]; then
-    VBMETAEXIST=true
+    PATCHVBMETAFLAG=false
   elif getprop ro.product.ab_ota_partitions | grep -wq vbmeta; then
-    VBMETAEXIST=true
+    PATCHVBMETAFLAG=false
+  else
+    PATCHVBMETAFLAG=true
   fi
-  # Preset PATCHVBMETAFLAG to false in the non-root case
-  PATCHVBMETAFLAG=false
-  # Make sure RECOVERYMODE has value
   [ -z $RECOVERYMODE ] && RECOVERYMODE=false
-  if grep ' / ' /proc/mounts | grep -q '/dev/root'; then
-    LEGACYSAR=true
+  if $SYSTEM_AS_ROOT; then
+    if grep ' / ' /proc/mounts | grep -q '/dev/root'; then
+      LEGACYSAR=true
+    else
+      LEGACYSAR=false
+    fi
   else
     LEGACYSAR=false
   fi
diff --git a/scripts/boot_patch.sh b/scripts/boot_patch.sh
index 57fc3d4ee..a3cca2167 100644
--- a/scripts/boot_patch.sh
+++ b/scripts/boot_patch.sh
@@ -5,7 +5,7 @@
 #
 # Usage: boot_patch.sh <bootimage>
 #
-# The following flags can be set in environment variables:
+# The following environment variables can configure the installation:
 # KEEPVERITY, KEEPFORCEENCRYPT, PATCHVBMETAFLAG, RECOVERYMODE, LEGACYSAR
 #
 # This script should be placed in a directory with the following files:
@@ -179,7 +179,6 @@ fi
 
 echo "KEEPVERITY=$KEEPVERITY" > config
 echo "KEEPFORCEENCRYPT=$KEEPFORCEENCRYPT" >> config
-echo "PATCHVBMETAFLAG=$PATCHVBMETAFLAG" >> config
 echo "RECOVERYMODE=$RECOVERYMODE" >> config
 if [ -n "$PREINITDEVICE" ]; then
   ui_print "- Pre-init storage partition: $PREINITDEVICE"
diff --git a/scripts/util_functions.sh b/scripts/util_functions.sh
index ad9fc9798..f2c41d825 100644
--- a/scripts/util_functions.sh
+++ b/scripts/util_functions.sh
@@ -279,7 +279,7 @@ mount_ro_ensure() {
 }
 
 # After calling this method, the following variables will be set:
-# SLOT, SYSTEM_ROOT
+# SLOT, SYSTEM_AS_ROOT
 mount_partitions() {
   # Check A/B slot
   SLOT=$(grep_cmdline androidboot.slot_suffix)
@@ -297,7 +297,7 @@ mount_partitions() {
   fi
   mount_ro_ensure "system$SLOT app$SLOT" /system
   if [ -f /system/init -o -L /system/init ]; then
-    SYSTEM_ROOT=true
+    SYSTEM_AS_ROOT=true
     setup_mntpoint /system_root
     if ! mount --move /system /system_root; then
       umount /system
@@ -307,63 +307,68 @@ mount_partitions() {
     mount -o bind /system_root/system /system
   else
     if grep ' / ' /proc/mounts | grep -qv 'rootfs' || grep -q ' /system_root ' /proc/mounts; then
-      SYSTEM_ROOT=true
+      SYSTEM_AS_ROOT=true
     else
-      SYSTEM_ROOT=false
+      SYSTEM_AS_ROOT=false
     fi
   fi
-  $SYSTEM_ROOT && ui_print "- Device is system-as-root"
+  $SYSTEM_AS_ROOT && ui_print "- Device is system-as-root"
 }
 
 # After calling this method, the following variables will be set:
-# KEEPVERITY, KEEPFORCEENCRYPT, RECOVERYMODE, PATCHVBMETAFLAG,
-# ISENCRYPTED, VBMETAEXIST, LEGACYSAR
+# ISENCRYPTED, PATCHVBMETAFLAG, LEGACYSAR,
+# KEEPVERITY, KEEPFORCEENCRYPT, RECOVERYMODE
 get_flags() {
+  if grep ' /data ' /proc/mounts | grep -q 'dm-'; then
+    ISENCRYPTED=true
+  elif [ "$(getprop ro.crypto.state)" = "encrypted" ]; then
+    ISENCRYPTED=true
+  elif [ "$DATA" = "false" ]
+    # No data access means unable to decrypt in recovery
+    ISENCRYPTED=true
+  else
+    ISENCRYPTED=false
+  fi
+  if [ -n "$(find_block vbmeta vbmeta_a)" ]; then
+    PATCHVBMETAFLAG=false
+  else
+    PATCHVBMETAFLAG=true
+    ui_print "- No vbmeta partition, patch vbmeta in boot image"
+  fi
+  local IS_DYNAMIC=false
+  if grep -q 'androidboot.super_partition' /proc/cmdline; then
+    IS_DYNAMIC=true
+  elif [ -n "$(find_block super)" ]; then
+    IS_DYNAMIC=true
+  fi
+  if $SYSTEM_AS_ROOT && ! $IS_DYNAMIC; then
+    LEGACYSAR=true
+    ui_print "- Legacy SAR, force kernel to load rootfs"
+  else
+    LEGACYSAR=false
+  fi
+
+  # Overridable config flags with safe defaults
   getvar KEEPVERITY
   getvar KEEPFORCEENCRYPT
   getvar RECOVERYMODE
-  getvar PATCHVBMETAFLAG
   if [ -z $KEEPVERITY ]; then
-    if $SYSTEM_ROOT; then
+    if $SYSTEM_AS_ROOT; then
       KEEPVERITY=true
-      ui_print "- System-as-root, keep dm/avb-verity"
+      ui_print "- System-as-root, keep dm-verity"
     else
       KEEPVERITY=false
     fi
   fi
-  ISENCRYPTED=false
-  grep ' /data ' /proc/mounts | grep -q 'dm-' && ISENCRYPTED=true
-  [ "$(getprop ro.crypto.state)" = "encrypted" ] && ISENCRYPTED=true
   if [ -z $KEEPFORCEENCRYPT ]; then
-    # No data access means unable to decrypt in recovery
-    if $ISENCRYPTED || ! $DATA; then
+    if $ISENCRYPTED; then
       KEEPFORCEENCRYPT=true
       ui_print "- Encrypted data, keep forceencrypt"
     else
       KEEPFORCEENCRYPT=false
     fi
   fi
-  VBMETAEXIST=false
-  local VBMETAIMG=$(find_block vbmeta vbmeta_a)
-  [ -n "$VBMETAIMG" ] && VBMETAEXIST=true
-  if [ -z $PATCHVBMETAFLAG ]; then
-    if $VBMETAEXIST; then
-      PATCHVBMETAFLAG=false
-    else
-      PATCHVBMETAFLAG=true
-      ui_print "- No vbmeta partition, patch vbmeta in boot image"
-    fi
-  fi
   [ -z $RECOVERYMODE ] && RECOVERYMODE=false
-  local IS_DYNAMIC=false
-  grep -q 'androidboot.super_partition' /proc/cmdline && IS_DYNAMIC=true
-  [ -b "/dev/block/by-name/super" ] && IS_DYNAMIC=true
-  if $SYSTEM_ROOT && ! $IS_DYNAMIC; then
-    LEGACYSAR=true
-    ui_print "- legacy SAR, force kernel to load rootfs"
-  else
-    LEGACYSAR=false
-  fi
 }
 
 find_boot_image() {