diff --git a/lib/src/boundimage.rs b/lib/src/boundimage.rs
index 07c8f2c28..24119b95d 100644
--- a/lib/src/boundimage.rs
+++ b/lib/src/boundimage.rs
@@ -20,15 +20,9 @@ const BOUND_IMAGE_DIR: &str = "usr/lib/bootc-experimental/bound-images.d";
 
 /// Given a deployment, pull all container images it references.
 pub(crate) fn pull_bound_images(sysroot: &SysrootLock, deployment: &Deployment) -> Result<()> {
-    let sysroot_fd = crate::utils::sysroot_fd(&sysroot);
-    let sysroot_fd = Dir::reopen_dir(&sysroot_fd)?;
-    let deployment_root_path = sysroot.deployment_dirpath(&deployment);
-    let deployment_root = &sysroot_fd.open_dir(&deployment_root_path)?;
-
-    let bound_images = parse_spec_dir(&deployment_root, BOUND_IMAGE_DIR)?;
-    pull_images(deployment_root, bound_images)?;
-
-    Ok(())
+    let deployment_root = &crate::utils::deployment_fd(sysroot, deployment)?;
+    let bound_images = parse_spec_dir(deployment_root, BOUND_IMAGE_DIR)?;
+    pull_images(deployment_root, bound_images)
 }
 
 #[context("parse bound image spec dir")]
diff --git a/lib/src/utils.rs b/lib/src/utils.rs
index 45c72fdbb..e704ca48c 100644
--- a/lib/src/utils.rs
+++ b/lib/src/utils.rs
@@ -31,7 +31,6 @@ pub(crate) fn sysroot_fd(sysroot: &ostree::Sysroot) -> BorrowedFd {
 
 // Return a cap-std `Dir` type for a deployment.
 // TODO: in the future this should perhaps actually mount via composefs
-#[allow(unsafe_code)]
 pub(crate) fn deployment_fd(
     sysroot: &ostree::Sysroot,
     deployment: &ostree::Deployment,