diff --git a/scripts/release/README.md b/scripts/release/README.md
index d1d9769..621fa5f 100644
--- a/scripts/release/README.md
+++ b/scripts/release/README.md
@@ -342,7 +342,8 @@ Prepare a separate Root-owned 0700, 16-GiB ext4 volume at
 `/var/lib/kf-onlinejudge/backups`, with `nosuid,nodev,noexec` and no shared mount.
 The fixed backup operator has `CAP_DAC_READ_SEARCH`, no-new-privileges, 256 MiB,
 zero swap, 32 tasks, 50% CPU, a 256-MiB file limit and a 30-minute deadline. Only
-that volume is writable.
+that volume is writable. Backup and restore use `MountFlags=private` so systemd
+does not introduce shared propagation in the operator mount namespace.
 
 Backup domains include PostgreSQL, source/case storage, private import staging,
 retained releases/images, configuration, replay history and operation receipts.
diff --git a/scripts/release/backup.py b/scripts/release/backup.py
index 8fb55e3..c3a104b 100644
--- a/scripts/release/backup.py
+++ b/scripts/release/backup.py
@@ -566,6 +566,7 @@ def launch(args) -> dict:
         "PrivateTmp": "yes",
         "PrivateDevices": "yes",
         "ProtectControlGroups": "yes",
+        "MountFlags": "private",
         "RestrictAddressFamilies": "AF_UNIX",
         "ReadWritePaths": str(ROOT),
     }.items():
diff --git a/scripts/release/restore.py b/scripts/release/restore.py
index 961c0d3..3e11059 100644
--- a/scripts/release/restore.py
+++ b/scripts/release/restore.py
@@ -328,6 +328,7 @@ def launch(recovery_id: str, backup_id: str, expected: str) -> dict:
         "PrivateTmp": "yes",
         "PrivateDevices": "yes",
         "ProtectControlGroups": "yes",
+        "MountFlags": "private",
         "RestrictAddressFamilies": "AF_UNIX AF_INET",
         "ReadOnlyPaths": str(backup.ROOT),
         "ReadWritePaths": " ".join(