diff --git a/core-services/10-runit-control.sh b/core-services/10-runit-control.sh
index f7173e8c..2ab78197 100644
--- a/core-services/10-runit-control.sh
+++ b/core-services/10-runit-control.sh
@@ -4,3 +4,7 @@
 mkdir -p /run/runit
 install -m000 /dev/null /run/runit/stopit
 install -m000 /dev/null /run/runit/reboot
+
+# ensure runit keeps link count >0 if the binary is updated,
+# so the rootfs can be remounted read-only
+ln -f /bin/runit /bin/.runit.booted