diff --git a/src/import/import-common.c b/src/import/import-common.c
index 327da2707e..ae54383e17 100644
--- a/src/import/import-common.c
+++ b/src/import/import-common.c
@@ -16,6 +16,7 @@
 #include "import-common.h"
 #include "libarchive-util.h"
 #include "log.h"
+#include "memory-util.h"
 #include "namespace-util.h"
 #include "nsresource.h"
 #include "os-util.h"
@@ -27,6 +28,44 @@
 #include "tar-util.h"
 #include "tmpfile-util.h"
 
+static int drain_null_padding(int fd) {
+        uint64_t n = 0;
+
+        assert(fd >= 0);
+
+        /* libarchive stops reading as soon as it encounters the end-of-archive marker, but tar archives are
+         * usually padded with zeroes to a full record size (10K for GNU tar) after it. Read and discard
+         * that, so that the writing side doesn't get EPIPE when it pushes the final bytes after we exited
+         * already. Insist that this padding is actually all zeroes though, and refuse any other trailing
+         * garbage. */
+
+        for (;;) {
+                uint8_t buf[64U*1024U];
+                ssize_t l;
+
+                l = read(fd, buf, sizeof(buf));
+                if (l < 0) {
+                        if (errno == EINTR)
+                                continue;
+
+                        return log_error_errno(errno, "Failed to read trailing archive padding: %m");
+                }
+                if (l == 0)
+                        break;
+
+                if (!memeqzero(buf, l))
+                        return log_error_errno(SYNTHETIC_ERRNO(EBADMSG),
+                                               "Non-zero trailing data after end of archive, refusing.");
+
+                n += l;
+        }
+
+        if (n > 0)
+                log_debug("Discarded %" PRIu64 " bytes of zero padding after end of archive.", n);
+
+        return 0;
+}
+
 int import_fork_tar_x(int tree_fd, int userns_fd, PidRef *ret_pid) {
         int r;
 
@@ -97,6 +136,9 @@ int import_fork_tar_x(int tree_fd, int userns_fd, PidRef *ret_pid) {
                 if (tar_x(pipefd[0], tree_fd, flags) < 0)
                         _exit(EXIT_FAILURE);
 
+                if (drain_null_padding(pipefd[0]) < 0)
+                        _exit(EXIT_FAILURE);
+
                 _exit(EXIT_SUCCESS);
         }