diff --git a/roles/bootstrap/tasks/main.yml b/roles/bootstrap/tasks/main.yml
index 5241040..a89565a 100644
--- a/roles/bootstrap/tasks/main.yml
+++ b/roles/bootstrap/tasks/main.yml
@@ -29,6 +29,21 @@
   loop_control:
     label: "{{ item.path }}"
 
+# Installers write their cache inside the installroot; redirect it off the 2 GiB CIS /var LV.
+- name: Create bootstrap package-cache directory
+  ansible.builtin.file:
+    path: /mnt/.bootstrap-cache
+    state: directory
+    mode: "0755"
+
+- name: Redirect package cache off the CIS /var LV
+  ansible.posix.mount:
+    src: /mnt/.bootstrap-cache
+    path: /mnt/var/cache
+    fstype: none
+    opts: bind
+    state: ephemeral
+
 - name: Run OS-specific bootstrap process
   vars:
     bootstrap_var_key: "{{ 'bootstrap_' + (os | replace('-lts', '') | replace('-', '_')) }}"
diff --git a/roles/cleanup/tasks/unmount.yml b/roles/cleanup/tasks/unmount.yml
index ee23251..cbbe7f9 100644
--- a/roles/cleanup/tasks/unmount.yml
+++ b/roles/cleanup/tasks/unmount.yml
@@ -2,6 +2,16 @@
 - name: Unmount Disks
   become: true
   block:
+    - name: Unmount the bootstrap package cache
+      ansible.posix.mount:
+        path: /mnt/var/cache
+        state: unmounted
+
+    - name: Remove the bootstrap package cache so it is not sealed into the image
+      ansible.builtin.file:
+        path: /mnt/.bootstrap-cache
+        state: absent
+
     - name: Disable Swap
       ansible.builtin.command: swapoff -a
       register: cleanup_swapoff_result