diff --git a/src/basic/mkdir.c b/src/basic/mkdir.c
index ed5c4546e4..6ebc2b95fd 100644
--- a/src/basic/mkdir.c
+++ b/src/basic/mkdir.c
@@ -136,7 +136,7 @@ int mkdir_parents_internal(const char *prefix, const char *path, mode_t mode, ui
                 if (prefix && path_startswith(prefix, t))
                         continue;
 
-                if (uid == UID_INVALID && gid == UID_INVALID && flags == 0) {
+                if (!uid_is_valid(uid) && !gid_is_valid(gid) && flags == 0) {
                         r = _mkdir(t, mode);
                         if (r < 0 && r != -EEXIST)
                                 return r;
@@ -167,7 +167,7 @@ int mkdir_p_internal(const char *prefix, const char *path, mode_t mode, uid_t ui
         if (r < 0)
                 return r;
 
-        if (uid == UID_INVALID && gid == UID_INVALID && flags == 0) {
+        if (!uid_is_valid(uid) && !gid_is_valid(gid) && flags == 0) {
                 r = _mkdir(path, mode);
                 if (r < 0 && (r != -EEXIST || is_dir(path, true) <= 0))
                         return r;
diff --git a/src/nspawn/nspawn-mount.c b/src/nspawn/nspawn-mount.c
index b07a214b61..4687ac4c18 100644
--- a/src/nspawn/nspawn-mount.c
+++ b/src/nspawn/nspawn-mount.c
@@ -563,10 +563,14 @@ int mount_all(const char *dest,
                   MOUNT_FATAL|MOUNT_MKDIR },
                 { "tmpfs",                  "/run",                         "tmpfs", "mode=755" TMPFS_LIMITS_RUN,      MS_NOSUID|MS_NODEV|MS_STRICTATIME,
                   MOUNT_FATAL|MOUNT_MKDIR },
-                { "/usr/lib/os-release",    "/run/host/usr/lib/os-release", NULL,    NULL,                             MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV,
-                  MOUNT_FATAL|MOUNT_MKDIR|MOUNT_TOUCH },
-                { "/etc/os-release",        "/run/host/etc/os-release",     NULL,    NULL,                             MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV,
+                { "/usr/lib/os-release",    "/run/host/usr/lib/os-release", NULL,    NULL,                             MS_BIND,
+                  MOUNT_FATAL|MOUNT_MKDIR|MOUNT_TOUCH }, /* As per kernel interface requirements, bind mount first (creating mount points) and make read-only later */
+                { NULL,                     "/run/host/usr/lib/os-release", NULL,    NULL,                             MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT,
+                  0 },
+                { "/etc/os-release",        "/run/host/etc/os-release",     NULL,    NULL,                             MS_BIND,
                   MOUNT_MKDIR|MOUNT_TOUCH },
+                { NULL,                     "/run/host/etc/os-release",     NULL,    NULL,                             MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT,
+                  0 },
 
 #if HAVE_SELINUX
                 { "/sys/fs/selinux",        "/sys/fs/selinux",              NULL,    NULL,                             MS_BIND,
@@ -587,7 +591,6 @@ int mount_all(const char *dest,
         for (k = 0; k < ELEMENTSOF(mount_table); k++) {
                 _cleanup_free_ char *where = NULL, *options = NULL;
                 const char *o;
-                struct stat source_st;
                 bool fatal = FLAGS_SET(mount_table[k].mount_settings, MOUNT_FATAL);
 
                 if (in_userns != FLAGS_SET(mount_table[k].mount_settings, MOUNT_IN_USERNS))
@@ -617,7 +620,7 @@ int mount_all(const char *dest,
                         /* Shortcut for optional bind mounts: if the source can't be found skip ahead to avoid creating
                          * empty and unused directories. */
                         if (!fatal && FLAGS_SET(mount_table[k].mount_settings, MOUNT_MKDIR) && FLAGS_SET(mount_table[k].flags, MS_BIND)) {
-                                r = stat(mount_table[k].what, &source_st);
+                                r = access(mount_table[k].what, F_OK);
                                 if (r < 0) {
                                         if (errno == ENOENT)
                                                 continue;
diff --git a/src/shared/os-util.c b/src/shared/os-util.c
index 7cca59d58a..042e77c8c7 100644
--- a/src/shared/os-util.c
+++ b/src/shared/os-util.c
@@ -130,7 +130,7 @@ int load_os_release_pairs_with_prefix(const char *root, const char *prefix, char
         STRV_FOREACH_PAIR(p, q, os_release_pairs) {
                 char *line;
 
-                // We strictly return only the four main ID fields and ignore the rest
+                /* We strictly return only the four main ID fields and ignore the rest */
                 if (!STR_IN_SET(*p, "ID", "VERSION_ID", "BUILD_ID", "VARIANT_ID"))
                         continue;
 
diff --git a/test/units/testsuite-13.sh b/test/units/testsuite-13.sh
index dd1c9575c4..0ad75ac8b0 100755
--- a/test/units/testsuite-13.sh
+++ b/test/units/testsuite-13.sh
@@ -67,6 +67,8 @@ if [ -n "${VERSION_ID:+set}" ] && [ "${VERSION_ID}" != "${container_host_version
 if [ -n "${BUILD_ID:+set}" ] && [ "${BUILD_ID}" != "${container_host_build_id}" ]; then exit 1; fi
 if [ -n "${VARIANT_ID:+set}" ] && [ "${VARIANT_ID}" != "${container_host_variant_id}" ]; then exit 1; fi
 cd /tmp; (cd /run/host/usr/lib; md5sum os-release) | md5sum -c
+if echo test >> /run/host/usr/lib/os-release; then exit 1; fi
+if echo test >> /run/host/etc/os-release; then exit 1; fi
 '
 
     systemd-nspawn --register=no -D /testsuite-13.nc-container --bind=/etc/os-release:/tmp/os-release /bin/sh -x -e -c "$_cmd"