diff --git a/Cargo.lock b/Cargo.lock
index 9af198b62..54a998ab4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -210,6 +210,7 @@ name = "bootc-utils"
 version = "0.0.0"
 dependencies = [
  "anyhow",
+ "rustix",
  "serde",
  "serde_json",
  "similar-asserts",
@@ -1417,6 +1418,7 @@ name = "ostree-ext"
 version = "0.15.3"
 dependencies = [
  "anyhow",
+ "bootc-utils",
  "camino",
  "cap-std-ext",
  "chrono",
diff --git a/lib/src/install.rs b/lib/src/install.rs
index 368794ef0..8587be138 100644
--- a/lib/src/install.rs
+++ b/lib/src/install.rs
@@ -840,7 +840,8 @@ async fn install_container(
 /// Run a command in the host mount namespace
 pub(crate) fn run_in_host_mountns(cmd: &str) -> Command {
     let mut c = Command::new("/proc/self/exe");
-    c.args(["exec-in-host-mount-namespace", cmd]);
+    c.lifecycle_bind()
+        .args(["exec-in-host-mount-namespace", cmd]);
     c
 }
 
diff --git a/lib/src/utils.rs b/lib/src/utils.rs
index 5d0a27c76..e8a3481d2 100644
--- a/lib/src/utils.rs
+++ b/lib/src/utils.rs
@@ -5,6 +5,7 @@ use std::process::Command;
 use std::time::Duration;
 
 use anyhow::{Context, Result};
+use bootc_utils::CommandRunExt;
 #[cfg(feature = "install")]
 use camino::Utf8Path;
 use cap_std_ext::cap_std::fs::Dir;
@@ -119,6 +120,7 @@ pub(crate) fn spawn_editor(tmpf: &tempfile::NamedTempFile) -> Result<()> {
     let status = Command::new(argv0)
         .args(editor_args)
         .arg(tmpf.path())
+        .lifecycle_bind()
         .status()
         .context("Spawning editor")?;
     if !status.success() {
diff --git a/ostree-ext/Cargo.toml b/ostree-ext/Cargo.toml
index 51ff650cb..f330b1de7 100644
--- a/ostree-ext/Cargo.toml
+++ b/ostree-ext/Cargo.toml
@@ -19,6 +19,7 @@ ostree = { features = ["v2022_6"], version = "0.19.0" }
 
 # Private dependencies
 anyhow = { workspace = true }
+bootc-utils = { path = "../utils" }
 camino = { workspace = true, features = ["serde1"] }
 chrono = { workspace = true }
 olpc-cjson = "0.1.1"
diff --git a/ostree-ext/src/container/deploy.rs b/ostree-ext/src/container/deploy.rs
index 09627cedf..dd5a4cad7 100644
--- a/ostree-ext/src/container/deploy.rs
+++ b/ostree-ext/src/container/deploy.rs
@@ -5,6 +5,7 @@ use std::os::fd::BorrowedFd;
 use std::process::Command;
 
 use anyhow::Result;
+use bootc_utils::CommandRunExt;
 use cap_std_ext::cmdext::CapStdExtCommandExt;
 use fn_error_context::context;
 use ocidir::cap_std::fs::Dir;
@@ -148,6 +149,7 @@ pub async fn deploy(
             let st = Command::new("/proc/self/exe")
                 .args(["internals", "bootc-install-completion", ".", stateroot])
                 .cwd_dir(sysroot_dir.try_clone()?)
+                .lifecycle_bind()
                 .status()?;
             if !st.success() {
                 anyhow::bail!("Failed to complete bootc install");
diff --git a/utils/Cargo.toml b/utils/Cargo.toml
index 9d002e78f..6aeda593d 100644
--- a/utils/Cargo.toml
+++ b/utils/Cargo.toml
@@ -8,6 +8,7 @@ repository = "https://github.com/containers/bootc"
 
 [dependencies]
 anyhow = { workspace = true }
+rustix = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 tempfile = { workspace = true }
diff --git a/utils/src/command.rs b/utils/src/command.rs
index d84000515..3db7d86fd 100644
--- a/utils/src/command.rs
+++ b/utils/src/command.rs
@@ -2,6 +2,7 @@
 
 use std::{
     io::{Read, Seek},
+    os::unix::process::CommandExt,
     process::Command,
 };
 
@@ -15,6 +16,9 @@ pub trait CommandRunExt {
     /// Execute the child process.
     fn run(&mut self) -> Result<()>;
 
+    /// Ensure the child does not outlive the parent.
+    fn lifecycle_bind(&mut self) -> &mut Self;
+
     /// Execute the child process and capture its output. This uses `run` internally
     /// and will return an error if the child process exits abnormally.
     fn run_get_output(&mut self) -> Result<Box<dyn std::io::BufRead>>;
@@ -84,6 +88,19 @@ impl CommandRunExt for Command {
         self.status()?.check_status(stderr)
     }
 
+    #[allow(unsafe_code)]
+    fn lifecycle_bind(&mut self) -> &mut Self {
+        // SAFETY: This API is safe to call in a forked child.
+        unsafe {
+            self.pre_exec(|| {
+                rustix::process::set_parent_process_death_signal(Some(
+                    rustix::process::Signal::Term,
+                ))
+                .map_err(Into::into)
+            })
+        }
+    }
+
     /// Output a debug-level log message with this command.
     fn log_debug(&mut self) -> &mut Self {
         // We unconditionally log at trace level, so avoid double logging