diff --git a/lib/src/cli.rs b/lib/src/cli.rs
index a336246e1..31707cfec 100644
--- a/lib/src/cli.rs
+++ b/lib/src/cli.rs
@@ -433,7 +433,7 @@ pub(crate) async fn get_locked_sysroot() -> Result<ostree_ext::sysroot::SysrootL
 #[context("Initializing storage")]
 pub(crate) async fn get_storage() -> Result<crate::store::Storage> {
     let sysroot = get_locked_sysroot().await?;
-    Ok(crate::store::Storage::new(sysroot))
+    crate::store::Storage::new(sysroot)
 }
 
 #[context("Querying root privilege")]
diff --git a/lib/src/install.rs b/lib/src/install.rs
index ae68f352b..cd7e068dc 100644
--- a/lib/src/install.rs
+++ b/lib/src/install.rs
@@ -44,6 +44,7 @@ use self::baseline::InstallBlockDeviceOpts;
 use crate::containerenv::ContainerExecutionInfo;
 use crate::mount::Filesystem;
 use crate::spec::ImageReference;
+use crate::store::Storage;
 use crate::task::Task;
 use crate::utils::sigpolicy_from_opts;
 
@@ -549,7 +550,7 @@ pub(crate) fn print_configuration() -> Result<()> {
 }
 
 #[context("Creating ostree deployment")]
-async fn initialize_ostree_root(state: &State, root_setup: &RootSetup) -> Result<ostree::Sysroot> {
+async fn initialize_ostree_root(state: &State, root_setup: &RootSetup) -> Result<Storage> {
     let sepolicy = state.load_policy()?;
     let sepolicy = sepolicy.as_ref();
     // Load a fd for the mounted target physical root
@@ -608,7 +609,8 @@ async fn initialize_ostree_root(state: &State, root_setup: &RootSetup) -> Result
 
     let sysroot = ostree::Sysroot::new(Some(&gio::File::for_path(rootfs)));
     sysroot.load(cancellable)?;
-    Ok(sysroot)
+    let sysroot = SysrootLock::new_from_sysroot(&sysroot).await?;
+    Storage::new(sysroot)
 }
 
 #[context("Creating ostree deployment")]
@@ -1270,11 +1272,10 @@ async fn prepare_install(
 async fn install_with_sysroot(
     state: &State,
     rootfs: &RootSetup,
-    sysroot: &ostree::Sysroot,
+    sysroot: &Storage,
     boot_uuid: &str,
     bound_images: &[crate::boundimage::ResolvedBoundImage],
 ) -> Result<()> {
-    let sysroot = SysrootLock::new_from_sysroot(&sysroot).await?;
     // And actually set up the container in that root, returning a deployment and
     // the aleph state (see below).
     let (deployment, aleph) = install_container(state, rootfs, &sysroot).await?;
diff --git a/lib/src/store/mod.rs b/lib/src/store/mod.rs
index 8a30cedc8..713341772 100644
--- a/lib/src/store/mod.rs
+++ b/lib/src/store/mod.rs
@@ -48,7 +48,7 @@ impl Deref for Storage {
 }
 
 impl Storage {
-    pub fn new(sysroot: SysrootLock) -> Self {
+    pub fn new(sysroot: SysrootLock) -> Result<Self> {
         let store = match env::var("BOOTC_STORAGE") {
             Ok(val) => crate::spec::Store::from_str(&val, true).unwrap_or_else(|_| {
                 let default = crate::spec::Store::default();
@@ -60,7 +60,7 @@ impl Storage {
 
         let store = load(store);
 
-        Self { sysroot, store }
+        Ok(Self { sysroot, store })
     }
 }