diff --git a/native/jni/core/bootstages.cpp b/native/jni/core/bootstages.cpp
index 3837cb686..6f71569bd 100644
--- a/native/jni/core/bootstages.cpp
+++ b/native/jni/core/bootstages.cpp
@@ -26,17 +26,20 @@ static bool safe_mode = false;
 #define SETMIR(b, part)   sprintf(b, "%s/" MIRRDIR "/" #part, MAGISKTMP.data())
 #define SETBLK(b, part)   sprintf(b, "%s/" BLOCKDIR "/" #part, MAGISKTMP.data())
 
-#define mount_mirror(part, flag) \
-else if (MNT_DIR_IS("/" #part) && me->mnt_type != "tmpfs"sv && lstat(me->mnt_dir, &st) == 0) { \
-	SETMIR(buf1, part); \
-	SETBLK(buf2, part); \
-	unlink(buf2); \
-	mknod(buf2, S_IFBLK | 0600, st.st_dev); \
-	xmkdir(buf1, 0755); \
-	xmount(buf2, buf1, me->mnt_type, flag, nullptr); \
-	LOGI("mount: %s\n", buf1); \
+#define do_mount_mirror(part, flag) {\
+    SETMIR(buf1, part); \
+    SETBLK(buf2, part); \
+    unlink(buf2); \
+    mknod(buf2, S_IFBLK | 0600, st.st_dev); \
+    xmkdir(buf1, 0755); \
+    xmount(buf2, buf1, me->mnt_type, flag, nullptr); \
+    LOGI("mount: %s\n", buf1); \
 }
 
+#define mount_mirror(part, flag) \
+else if (MNT_DIR_IS("/" #part) && me->mnt_type != "tmpfs"sv && lstat(me->mnt_dir, &st) == 0) \
+	do_mount_mirror(part, flag)
+
 #define link_mirror(part) \
 SETMIR(buf1, part); \
 if (access("/system/" #part, F_OK) == 0 && access(buf1, F_OK) != 0) { \
@@ -119,10 +122,17 @@ static bool magisk_env() {
 		return true;
 	});
 	SETMIR(buf1, system);
-	SETMIR(buf2, system_root);
-	if (access(buf1, F_OK) != 0 && access(buf2, F_OK) == 0) {
+	if (access(buf1, F_OK) != 0) {
 		xsymlink("./system_root/system", buf1);
 		LOGI("link: %s\n", buf1);
+		parse_mnt("/proc/mounts", [&](mntent *me) {
+			struct stat st;
+			if (MNT_DIR_IS("/") && me->mnt_type != "rootfs"sv && stat("/", &st) == 0) {
+				do_mount_mirror(system_root, MS_RDONLY)
+				return false;
+			}
+			return true;
+		});
 	}
 	link_mirror(vendor)
 	link_mirror(product)
diff --git a/native/jni/init/rootdir.cpp b/native/jni/init/rootdir.cpp
index 1c3f76836..19e3e8066 100644
--- a/native/jni/init/rootdir.cpp
+++ b/native/jni/init/rootdir.cpp
@@ -183,13 +183,12 @@ static void magic_mount(const string &sdir, const string &ddir = "") {
 }
 
 #define ROOTMIR     MIRRDIR "/system_root"
-#define ROOTBLK     BLOCKDIR "/system_root"
 #define MONOPOLICY  "/sepolicy"
 #define LIBSELINUX  "/system/" LIBNAME "/libselinux.so"
 #define NEW_INITRC  "/system/etc/init/hw/init.rc"
 
 void SARBase::patch_rootdir() {
-	char tmp_dir[16];
+	char tmp_dir[32];
 	const char *sepol;
 
 	char *p;
@@ -208,13 +207,10 @@ void SARBase::patch_rootdir() {
 	mount_rules_dir(BLOCKDIR, MIRRDIR);
 
 	// Mount system_root mirror
-	struct stat st;
-	xstat("/", &st);
 	xmkdir(ROOTMIR, 0755);
-	mknod(ROOTBLK, S_IFBLK | 0600, st.st_dev);
-	strcpy(p, "/" ROOTBLK);
-	if (xmount(tmp_dir, ROOTMIR, "ext4", MS_RDONLY, nullptr))
-		xmount(tmp_dir, ROOTMIR, "erofs", MS_RDONLY, nullptr);
+	xmount("/", ROOTMIR, nullptr, MS_BIND, nullptr);
+	strcpy(p, "/" ROOTMIR);
+	mount_list.emplace_back(tmp_dir);
 	*p = '\0';
 
 	// Recreate original sbin structure if necessary