diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/coreos-rootflags.sh b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/coreos-rootflags.sh
new file mode 100755
index 0000000000..3cfe03576f
--- /dev/null
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/coreos-rootflags.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+set -euo pipefail
+
+rootpath=/dev/disk/by-label/root
+
+# If the rootfs was reprovisioned, then the user is free to define their own
+# rootflags.
+if [ -d /run/ignition-ostree-rootfs ]; then
+    exit 0
+fi
+
+eval $(blkid -o export ${rootpath})
+# this really should always be true, but let's be conservative
+if [ "${TYPE}" == "xfs" ]; then
+    # We use prjquota on XFS by default to aid multi-tenant Kubernetes (and
+    # other container) clusters.  See
+    # https://github.com/coreos/coreos-assembler/pull/303/commits/6103effbd006bb6109467830d6a3e42dd847668d
+    echo "prjquota"
+fi
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-mount-sysroot.sh b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-mount-sysroot.sh
index 047ba2da37..c981d0db45 100755
--- a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-mount-sysroot.sh
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-mount-sysroot.sh
@@ -1,20 +1,17 @@
 #!/bin/bash
 set -euo pipefail
 
-# We use prjquota on XFS by default to aid multi-tenant
-# Kubernetes (and other container) clusters.  See
-# https://github.com/coreos/coreos-assembler/pull/303/commits/6103effbd006bb6109467830d6a3e42dd847668d
-# In the future this will be augmented with a check for whether
-# or not we've reprovisioned the rootfs, since we don't want to
-# force on prjquota there.
+# Note that on *new machines* this script is now only ever used on firstboot. On
+# subsequent boots, systemd-fstab-generator mounts /sysroot from the
+# root=UUID=... and rootflags=... kargs.
+
+# We may do a migration window at some point where older machines have these
+# kargs injected so that we can simplify the model further.
+
 rootpath=/dev/disk/by-label/root
 if ! [ -b "${rootpath}" ]; then
   echo "ignition-ostree-mount-sysroot: Failed to find ${rootpath}" 1>&2
   exit 1
 fi
-eval $(blkid -o export ${rootpath})
-mountflags=
-if [ "${TYPE}" == "xfs" ]; then
-  mountflags=prjquota
-fi
-mount -o "${mountflags}" "${rootpath}" /sysroot
+
+mount -o "$(coreos-rootflags)" "${rootpath}" /sysroot
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/module-setup.sh b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/module-setup.sh
index 11e47f7eb5..09eb7f2153 100755
--- a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/module-setup.sh
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/module-setup.sh
@@ -82,6 +82,8 @@ install() {
     install_ignition_unit ignition-ostree-mount-subsequent-sysroot.service diskful-subsequent
     inst_script "$moddir/ignition-ostree-mount-sysroot.sh" \
         "/usr/sbin/ignition-ostree-mount-sysroot"
+    inst_script "$moddir/coreos-rootflags.sh" \
+        "/usr/sbin/coreos-rootflags"
 
     install_ignition_unit ignition-ostree-growfs.service
     inst_script "$moddir/coreos-growpart" /usr/libexec/coreos-growpart