diff --git a/pressure-vessel/flatpak-exports.c b/pressure-vessel/flatpak-exports.c
index c3af3a1c5817f6707ef7a1b759741dd40a0dcae2..eb1a05a1ae52c2597dc693a358101346a1fc864c 100644
--- a/pressure-vessel/flatpak-exports.c
+++ b/pressure-vessel/flatpak-exports.c
@@ -976,6 +976,17 @@ _exports_path_expose (FlatpakExports *exports,
           g_debug ("skipping export for path %s in unsupported prefix", path);
           return FALSE;
         }
+
+      /* Also don't expose directories that are a parent of a directory
+       * that is "owned" by the sandboxing framework. For example, because
+       * Flatpak controls /run/host and /run/flatpak, we cannot allow
+       * --filesystem=/run, which would prevent us from creating the
+       * contents of /run/host and /run/flatpak. */
+      if (flatpak_has_path_prefix (pv_reserved_paths[i], path))
+        {
+          g_debug ("skipping export for path %s above unsupported prefix", path);
+          return FALSE;
+        }
     }
 
   for (i = 0; flatpak_abs_usrmerged_dirs[i] != NULL; i++)
diff --git a/pressure-vessel/wrap-context.c b/pressure-vessel/wrap-context.c
index 112175829de9519e837efaf0a2060cdc4f5ae8dd..e8c4222e42d9b7c5c6c9bb72b36a7279833471ea 100644
--- a/pressure-vessel/wrap-context.c
+++ b/pressure-vessel/wrap-context.c
@@ -1085,6 +1085,13 @@ pv_wrap_context_export_if_allowed (PvWrapContext *self,
                               source, before, after, flags);
           return FALSE;
         }
+
+      if (_srt_get_path_after (reserved_paths[i], path) != NULL)
+        {
+          export_not_allowed (self, path, reserved_paths[i],
+                              source, before, after, flags);
+          return FALSE;
+        }
     }
 
   if (g_strcmp0 (path, host_path) == 0)