diff --git a/rust/src/bwrap.rs b/rust/src/bwrap.rs
index 5bf6cdff28..58f08663b1 100644
--- a/rust/src/bwrap.rs
+++ b/rust/src/bwrap.rs
@@ -167,9 +167,9 @@ impl Bubblewrap {
         let lang_var = Path::new(&lang_var);
 
         let launcher = gio::SubprocessLauncher::new(gio::SubprocessFlags::NONE);
-        let child_rootfs_fd = rootfs_fd.as_raw_fd();
+        let child_rootfs_fd = std::sync::Arc::new(rootfs_fd.try_clone()?);
         launcher.set_child_setup(move || {
-            nix::unistd::fchdir(child_rootfs_fd).expect("fchdir");
+            rustix::process::fchdir(&*child_rootfs_fd).expect("fchdir");
         });
 
         let path_var = Path::new(PATH_VAR);
diff --git a/rust/src/cliwrap/cliutil.rs b/rust/src/cliwrap/cliutil.rs
index 5cfb9d525b..b02a027719 100644
--- a/rust/src/cliwrap/cliutil.rs
+++ b/rust/src/cliwrap/cliutil.rs
@@ -1,7 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0 OR MIT
 
 use anyhow::Result;
-use nix::sys::statvfs;
 use std::os::unix::process::CommandExt;
 use std::{thread, time};
 
@@ -9,9 +8,10 @@ use crate::cliwrap;
 
 /// Returns true if /usr is not a read-only bind mount
 pub fn is_unlocked() -> Result<bool> {
-    Ok(!statvfs::statvfs("/usr")?
-        .flags()
-        .contains(statvfs::FsFlags::ST_RDONLY))
+    use rustix::fs::StatVfsMountFlags;
+    Ok(!rustix::fs::statvfs("/usr")?
+        .f_flag
+        .contains(StatVfsMountFlags::RDONLY))
 }
 
 /// Returns true if the current process is running as root.
diff --git a/rust/src/main.rs b/rust/src/main.rs
index cb32e817bb..0b5eec5da6 100644
--- a/rust/src/main.rs
+++ b/rust/src/main.rs
@@ -3,7 +3,6 @@
 
 use anyhow::{Context, Result};
 use is_terminal::IsTerminal;
-use nix::sys::signal;
 use rpmostree_rust::builtins;
 use std::ffi::OsString;
 use std::io::Write;
@@ -113,7 +112,8 @@ fn inner_main() -> Result<i32> {
     if std::env::var("RPMOSTREE_GDB_HOOK").is_ok() {
         println!("RPMOSTREE_GDB_HOOK detected; stopping...");
         println!("Attach via gdb using `gdb -p {}`.", std::process::id());
-        signal::raise(signal::Signal::SIGSTOP).expect("signal(SIGSTOP)");
+        rustix::process::kill_current_process_group(rustix::process::Signal::Stop)
+            .expect("signal(SIGSTOP)");
     }
     // Initialize failpoints
     let _scenario = fail::FailScenario::setup();