diff --git a/lib/src/cli.rs b/lib/src/cli.rs
index f4b4077fc..958bb4813 100644
--- a/lib/src/cli.rs
+++ b/lib/src/cli.rs
@@ -533,7 +533,7 @@ async fn upgrade(opts: UpgradeOpts) -> Result<()> {
             }
         }
     } else {
-        let fetched = crate::deploy::pull(sysroot, imgref, opts.quiet).await?;
+        let fetched = crate::deploy::pull(repo, imgref, opts.quiet).await?;
         let kargs = crate::kargs::get_kargs(repo, &booted_deployment, fetched.as_ref())?;
         let staged_digest = staged_image.as_ref().map(|s| s.image_digest.as_str());
         let fetched_digest = fetched.manifest_digest.as_str();
@@ -630,7 +630,7 @@ async fn switch(opts: SwitchOpts) -> Result<()> {
     }
     let new_spec = RequiredHostSpec::from_spec(&new_spec)?;
 
-    let fetched = crate::deploy::pull(sysroot, &target, opts.quiet).await?;
+    let fetched = crate::deploy::pull(repo, &target, opts.quiet).await?;
     let kargs = crate::kargs::get_kargs(repo, &booted_deployment, fetched.as_ref())?;
 
     if !opts.retain {
@@ -664,6 +664,8 @@ async fn rollback(_opts: RollbackOpts) -> Result<()> {
 #[context("Editing spec")]
 async fn edit(opts: EditOpts) -> Result<()> {
     let sysroot = &get_locked_sysroot().await?;
+    let repo = &sysroot.repo();
+
     let (booted_deployment, _deployments, host) =
         crate::status::get_status_require_booted(sysroot)?;
     let new_host: Host = if let Some(filename) = opts.filename {
@@ -690,8 +692,7 @@ async fn edit(opts: EditOpts) -> Result<()> {
         return crate::deploy::rollback(sysroot).await;
     }
 
-    let fetched = crate::deploy::pull(sysroot, new_spec.image, opts.quiet).await?;
-    let repo = &sysroot.repo();
+    let fetched = crate::deploy::pull(repo, new_spec.image, opts.quiet).await?;
     let kargs = crate::kargs::get_kargs(repo, &booted_deployment, fetched.as_ref())?;
 
     // TODO gc old layers here
diff --git a/lib/src/deploy.rs b/lib/src/deploy.rs
index 690550e2e..7a3f4a6fb 100644
--- a/lib/src/deploy.rs
+++ b/lib/src/deploy.rs
@@ -164,11 +164,10 @@ async fn handle_layer_progress_print(
 /// Wrapper for pulling a container image, wiring up status output.
 #[context("Pulling")]
 pub(crate) async fn pull(
-    sysroot: &SysrootLock,
+    repo: &ostree::Repo,
     imgref: &ImageReference,
     quiet: bool,
 ) -> Result<Box<ImageState>> {
-    let repo = &sysroot.repo();
     let ostree_imgref = &OstreeImageReference::from(imgref.clone());
     let mut imp = new_importer(repo, ostree_imgref).await?;
     let prep = match imp.prepare().await? {
diff --git a/lib/src/install.rs b/lib/src/install.rs
index b9d6a653e..07f179cf8 100644
--- a/lib/src/install.rs
+++ b/lib/src/install.rs
@@ -40,6 +40,7 @@ use serde::{Deserialize, Serialize};
 use self::baseline::InstallBlockDeviceOpts;
 use crate::containerenv::ContainerExecutionInfo;
 use crate::mount::Filesystem;
+use crate::spec::ImageReference;
 use crate::task::Task;
 use crate::utils::sigpolicy_from_opts;
 
@@ -651,6 +652,12 @@ async fn initialize_ostree_root_from_self(
         imgref: src_imageref,
     };
 
+    // Pull the container image into the target root filesystem.
+    {
+        let spec_imgref = ImageReference::from(src_imageref.clone());
+        crate::deploy::pull(&sysroot.repo(), &spec_imgref, false).await?;
+    }
+
     // Load the kargs from the /usr/lib/bootc/kargs.d from the running root,
     // which should be the same as the filesystem we'll deploy.
     let kargsd = crate::kargs::get_kargs_in_root(container_rootfs, std::env::consts::ARCH)?;