diff --git a/src/bootupd.rs b/src/bootupd.rs
index c9411c50..fd749155 100644
--- a/src/bootupd.rs
+++ b/src/bootupd.rs
@@ -101,7 +101,8 @@ pub(crate) fn update(name: &str) -> Result<ComponentUpdateResult> {
     } else {
         anyhow::bail!("Component {} is not installed", name);
     };
-    let update = component.query_update()?;
+    let sysroot = openat::Dir::open("/")?;
+    let update = component.query_update(&sysroot)?;
     let update = match update.as_ref() {
         Some(p) if inst.meta.can_upgrade_to(&p) => p,
         _ => return Ok(ComponentUpdateResult::AtLatestVersion),
@@ -110,8 +111,8 @@ pub(crate) fn update(name: &str) -> Result<ComponentUpdateResult> {
     let mut pending_container = state.pending.take().unwrap_or_default();
     let interrupted = pending_container.get(component.name()).cloned();
     pending_container.insert(component.name().into(), update.clone());
-    let mut state_guard = SavedState::acquire_write_lock(openat::Dir::open("/")?)
-        .context("Failed to acquire write lock")?;
+    let mut state_guard =
+        SavedState::acquire_write_lock(sysroot).context("Failed to acquire write lock")?;
     state_guard
         .update_state(&state)
         .context("Failed to update state")?;
@@ -132,18 +133,19 @@ pub(crate) fn update(name: &str) -> Result<ComponentUpdateResult> {
 
 /// daemon implementation of component adoption
 pub(crate) fn adopt_and_update(name: &str) -> Result<ContentMetadata> {
+    let sysroot = openat::Dir::open("/")?;
     let mut state = SavedState::load_from_disk("/")?.unwrap_or_default();
     let component = component::new_from_name(name)?;
     if state.installed.get(name).is_some() {
         anyhow::bail!("Component {} is already installed", name);
     };
-    let update = if let Some(update) = component.query_update()? {
+    let update = if let Some(update) = component.query_update(&sysroot)? {
         update
     } else {
         anyhow::bail!("Component {} has no available update", name);
     };
-    let mut state_guard = SavedState::acquire_write_lock(openat::Dir::open("/")?)
-        .context("Failed to acquire write lock")?;
+    let mut state_guard =
+        SavedState::acquire_write_lock(sysroot).context("Failed to acquire write lock")?;
 
     let inst = component
         .adopt_update(&state_guard.sysroot, &update)
@@ -169,6 +171,7 @@ pub(crate) fn validate(name: &str) -> Result<ValidationResult> {
 pub(crate) fn status() -> Result<Status> {
     let mut ret: Status = Default::default();
     let mut known_components = get_components();
+    let sysroot = openat::Dir::open("/")?;
     let state = SavedState::load_from_disk("/")?;
     if let Some(state) = state {
         for (name, ic) in state.installed.iter() {
@@ -182,7 +185,7 @@ pub(crate) fn status() -> Result<Status> {
                 .as_ref()
                 .map(|p| p.get(name.as_str()))
                 .flatten();
-            let update = component.query_update()?;
+            let update = component.query_update(&sysroot)?;
             let updatable = ComponentUpdatable::from_metadata(&ic.meta, update.as_ref());
             let adopted_from = ic.adopted_from.clone();
             ret.components.insert(
diff --git a/src/component.rs b/src/component.rs
index 2b056e9d..1e9c1f0e 100644
--- a/src/component.rs
+++ b/src/component.rs
@@ -53,7 +53,7 @@ pub(crate) trait Component {
     fn generate_update_metadata(&self, sysroot: &str) -> Result<ContentMetadata>;
 
     /// Used on the client to query for an update cached in the current booted OS.
-    fn query_update(&self) -> Result<Option<ContentMetadata>>;
+    fn query_update(&self, sysroot: &openat::Dir) -> Result<Option<ContentMetadata>>;
 
     /// Used on the client to run an update.
     fn run_update(
@@ -110,10 +110,9 @@ pub(crate) fn write_update_metadata(
 
 /// Given a component, return metadata on the available update (if any)
 pub(crate) fn get_component_update(
-    sysroot: &str,
+    sysroot: &openat::Dir,
     component: &dyn Component,
 ) -> Result<Option<ContentMetadata>> {
-    let sysroot = openat::Dir::open(sysroot)?;
     let name = component_update_data_name(component);
     let path = Path::new(BOOTUPD_UPDATES_DIR).join(name);
     if let Some(f) = sysroot.open_file_optional(&path)? {
diff --git a/src/efi.rs b/src/efi.rs
index 9e0614b3..76be8f44 100644
--- a/src/efi.rs
+++ b/src/efi.rs
@@ -103,7 +103,8 @@ impl Component for EFI {
     }
 
     fn install(&self, src_root: &str, dest_root: &str) -> Result<InstalledContent> {
-        let meta = if let Some(meta) = get_component_update(src_root, self)? {
+        let src_rootd = openat::Dir::open(src_root)?;
+        let meta = if let Some(meta) = get_component_update(&src_rootd, self)? {
             meta
         } else {
             anyhow::bail!("No update metadata for component {} found", self.name());
@@ -142,7 +143,7 @@ impl Component for EFI {
             .filetree
             .as_ref()
             .ok_or_else(|| anyhow::anyhow!("No filetree for installed EFI found!"))?;
-        let updatemeta = self.query_update()?.expect("update available");
+        let updatemeta = self.query_update(sysroot)?.expect("update available");
         let updated = sysroot
             .sub_dir(&component_updatedirname(self))
             .context("opening update dir")?;
@@ -243,8 +244,8 @@ impl Component for EFI {
         Ok(meta)
     }
 
-    fn query_update(&self) -> Result<Option<ContentMetadata>> {
-        get_component_update("/", self)
+    fn query_update(&self, sysroot: &openat::Dir) -> Result<Option<ContentMetadata>> {
+        get_component_update(sysroot, self)
     }
 
     fn validate(&self, current: &InstalledContent) -> Result<ValidationResult> {