diff --git a/pkg/worker/image.go b/pkg/worker/image.go
index bb1f803..3aceaec 100644
--- a/pkg/worker/image.go
+++ b/pkg/worker/image.go
@@ -2469,6 +2469,22 @@ func buildahIsolationArgs() []string {
 	return []string{"--isolation=oci", "--pid=private", "--ipc=private", "--network=private"}
 }
 
+// buildahStorageArgs are the global flags selecting a build's store. Builds on a
+// worker share a graphroot and each have a runroot, and containers/storage keeps
+// its mount counts in the runroot. By default the overlay driver bind-mounts its
+// home on itself, and any buildah process that exits seeing no mounts of its own
+// unmounts that home lazily, taking other builds' rootfs with it: their next RUN
+// fails on an empty directory. Pods mount the cache privately, so the bind mount
+// adds nothing here. This must be a flag: --storage-driver makes buildah discard
+// the driver options in storage.conf. vfs has no home mount and refuses the option.
+func buildahStorageArgs(graphroot, runroot, driver string) []string {
+	args := []string{"--root", graphroot, "--runroot", runroot, "--storage-driver=" + driver}
+	if driver == "overlay" {
+		args = append(args, "--storage-opt", "overlay.skip_mount_home=true")
+	}
+	return args
+}
+
 // buildahEnv returns environment variables for buildah
 func (c *ImageClient) buildahEnv(runroot, tmpdir, storageConf string) []string {
 	env := append(os.Environ(),
@@ -2892,7 +2908,7 @@ func (c *ImageClient) BuildAndArchiveImage(ctx context.Context, outputLogger *sl
 			outputLogger.Info("Using cached base image layers\n")
 		} else {
 			// buildah pull the base image so bud doesn't attempt HTTPS
-			pullArgs := []string{"--root", graphroot, "--runroot", runroot, "--storage-driver=" + storageDriver, "pull"}
+			pullArgs := append(buildahStorageArgs(graphroot, runroot, storageDriver), "pull")
 			if insecure {
 				pullArgs = append(pullArgs, "--tls-verify=false")
 			}
@@ -2931,7 +2947,7 @@ func (c *ImageClient) BuildAndArchiveImage(ctx context.Context, outputLogger *sl
 	fmt.Fprint(f, dockerfile)
 	f.Close()
 
-	budArgs := []string{"--root", graphroot, "--runroot", runroot, "--storage-driver=" + storageDriver, "bud"}
+	budArgs := append(buildahStorageArgs(graphroot, runroot, storageDriver), "bud")
 	budArgs = append(budArgs, buildahIsolationArgs()...)
 	if insecure {
 		budArgs = append(budArgs, "--tls-verify=false")
@@ -3040,7 +3056,7 @@ func (c *ImageClient) BuildAndArchiveImage(ctx context.Context, outputLogger *sl
 	}
 
 	// Push to local OCI layout (v1 clip path)
-	v1PushArgs := []string{"--root", graphroot, "--runroot", runroot, "--storage-driver=" + storageDriver, "push", request.ImageId + ":latest", "oci:" + ociPath + ":latest"}
+	v1PushArgs := append(buildahStorageArgs(graphroot, runroot, storageDriver), "push", request.ImageId+":latest", "oci:"+ociPath+":latest")
 	cmd = newBuildahCommand(
 		ctx,
 		v1PushArgs,
@@ -3359,7 +3375,7 @@ type buildahStore struct {
 }
 
 func (s *buildahStore) args(sub string) []string {
-	return []string{"--root", s.graphroot, "--runroot", s.runroot, "--storage-driver=" + s.driver, sub}
+	return append(buildahStorageArgs(s.graphroot, s.runroot, s.driver), sub)
 }
 
 // publishFromStorage pushes the image tagged imageTag straight from buildah
diff --git a/pkg/worker/image_build_layered.go b/pkg/worker/image_build_layered.go
index 43dc944..769b1de 100644
--- a/pkg/worker/image_build_layered.go
+++ b/pkg/worker/image_build_layered.go
@@ -63,7 +63,7 @@ type layeredBuild struct {
 }
 
 func (b *layeredBuild) storageArgs(sub string) []string {
-	return []string{"--root", b.graphroot, "--runroot", b.runroot, "--storage-driver=" + b.storage, sub}
+	return append(buildahStorageArgs(b.graphroot, b.runroot, b.storage), sub)
 }
 
 // quiet runs a buildah subcommand, returning the last line of its stdout (the