diff --git a/tier-0/bootc.yaml b/tier-0/bootc.yaml
index 456bb31..a964aa9 100644
--- a/tier-0/bootc.yaml
+++ b/tier-0/bootc.yaml
@@ -1,7 +1,9 @@
+include:
+  - ostree.yaml
+
 # The bootc components.
 packages:
  - systemd
- - ostree nss-altfiles
  # For now this will be shipped in rpm-ostree; TODO fix this by shipping a separate epackage
  # - bootc
  # Required by bootc install today, though we'll likely switch bootc to use a Rust crate instead of sgdisk
diff --git a/tier-0/ostree.yaml b/tier-0/ostree.yaml
new file mode 100644
index 0000000..12a3b25
--- /dev/null
+++ b/tier-0/ostree.yaml
@@ -0,0 +1,12 @@
+packages:
+ - ostree nss-altfiles
+
+postprocess:
+  # Set up default root config
+  - |
+    #!/usr/bin/env bash
+    mkdir -p /usr/lib/ostree
+    cat > /usr/lib/ostree/prepare-root.conf << EOF
+    [sysroot]
+    readonly = true
+    EOF
diff --git a/tier-1/ostree.yaml b/tier-1/ostree.yaml
new file mode 120000
index 0000000..174954e
--- /dev/null
+++ b/tier-1/ostree.yaml
@@ -0,0 +1 @@
+../tier-0/ostree.yaml
\ No newline at end of file