diff --git a/src/nspawn/nspawn-mount.c b/src/nspawn/nspawn-mount.c
index 9de20126f4..ee00362b54 100644
--- a/src/nspawn/nspawn-mount.c
+++ b/src/nspawn/nspawn-mount.c
@@ -794,7 +794,7 @@ static int mount_bind(const char *dest, CustomMount *m, uid_t uid_shift, uid_t u
                                                m->source, where);
 
         } else { /* Path doesn't exist yet? */
-                r = mkdir_parents_label(where, 0755);
+                r = mkdir_parents_safe_label(dest, where, 0755, uid_shift, uid_shift, MKDIR_IGNORE_EXISTING);
                 if (r < 0)
                         return log_error_errno(r, "Failed to make parents of %s: %m", where);
 
@@ -808,6 +808,9 @@ static int mount_bind(const char *dest, CustomMount *m, uid_t uid_shift, uid_t u
                         r = touch(where);
                 if (r < 0)
                         return log_error_errno(r, "Failed to create mount point %s: %m", where);
+
+                if (chown(where, uid_shift, uid_shift) < 0)
+                        return log_error_errno(errno, "Failed to chown %s: %m", where);
         }
 
         r = mount_nofollow_verbose(LOG_ERR, m->source, where, NULL, mount_flags, mount_opts);
diff --git a/src/shared/mkdir-label.c b/src/shared/mkdir-label.c
index 53081d5e17..e3afc2b666 100644
--- a/src/shared/mkdir-label.c
+++ b/src/shared/mkdir-label.c
@@ -33,6 +33,10 @@ int mkdirat_parents_label(int dir_fd, const char *path, mode_t mode) {
         return mkdirat_parents_internal(dir_fd, path, mode, UID_INVALID, UID_INVALID, 0, mkdirat_label);
 }
 
+int mkdir_parents_safe_label(const char *prefix, const char *path, mode_t mode, uid_t uid, gid_t gid, MkdirFlags flags) {
+        return mkdir_parents_internal(prefix, path, mode, uid, gid, flags, mkdirat_label);
+}
+
 int mkdir_p_label(const char *path, mode_t mode) {
         return mkdir_p_internal(NULL, path, mode, UID_INVALID, UID_INVALID, 0, mkdirat_label);
 }
diff --git a/src/shared/mkdir-label.h b/src/shared/mkdir-label.h
index dcbe5bd546..a9a8ce3a59 100644
--- a/src/shared/mkdir-label.h
+++ b/src/shared/mkdir-label.h
@@ -20,4 +20,7 @@ int mkdirat_parents_label(int dir_fd, const char *path, mode_t mod);
 static inline int mkdir_parents_label(const char *path, mode_t mod) {
         return mkdirat_parents_label(AT_FDCWD, path, mod);
 }
+
+int mkdir_parents_safe_label(const char *prefix, const char *path, mode_t mode, uid_t uid, gid_t gid, MkdirFlags flags);
+
 int mkdir_p_label(const char *path, mode_t mode);