diff --git a/lib/namespace b/lib/namespace
index a53ff1f39..40218f243 100644
--- a/lib/namespace
+++ b/lib/namespace
@@ -12,14 +12,15 @@ bind -qa #¶ /dev
 mount -C /srv/boot /root $rootspec
 bind -a $rootdir /
 
-# authentication
-mount -b /srv/factotum /mnt
-
 # mount points
 mount -a /srv/slashn /n
 mount -a /srv/slashmnt /mnt
 mount -a /srv/mntexport /mnt/exportfs
 
+# authentication
+mount /srv/factotum /mnt/factotum factotum
+bind -q /mnt/factotum/factotum /mnt/factotum
+
 # standard bin
 bind /$cputype/bin /bin
 bind $rootdir/rc /rc
diff --git a/rc/bin/cpurc b/rc/bin/cpurc
index 64576200f..5719e24eb 100755
--- a/rc/bin/cpurc
+++ b/rc/bin/cpurc
@@ -17,11 +17,9 @@ mntgen -s slashn /n && chmod 666 /srv/slashn
 mntgen -s slashmnt /mnt && chmod 666 /srv/slashmnt
 mntgen -s mntexport /mnt/exportfs && chmod 666 /srv/mntexport}
 
-# move factotum from /mnt to /mnt/factotum
-mount /srv/factotum /mnt/temp
-unmount /srv/factotum /mnt
-bind /mnt/temp/factotum /mnt/factotum
-unmount /mnt/temp
+# now that /mnt exists, mount factotum
+mount /srv/factotum /mnt/factotum factotum
+bind -q /mnt/factotum/factotum /mnt/factotum
 
 # usb listener
 nusbrc
diff --git a/rc/bin/termrc b/rc/bin/termrc
index 380f78636..f9dc81b10 100755
--- a/rc/bin/termrc
+++ b/rc/bin/termrc
@@ -18,11 +18,9 @@ mntgen -s slashn /n && chmod 666 /srv/slashn
 mntgen -s slashmnt /mnt && chmod 666 /srv/slashmnt
 mntgen -s mntexport /mnt/exportfs && chmod 666 /srv/mntexport}
 
-# move factotum from /mnt to /mnt/factotum
-mount /srv/factotum /mnt/temp
-unmount /srv/factotum /mnt
-bind /mnt/temp/factotum /mnt/factotum
-unmount /mnt/temp
+# now that /mnt exists, mount factotum
+mount /srv/factotum /mnt/factotum factotum
+bind -q /mnt/factotum/factotum /mnt/factotum
 
 # usb listener
 nusbrc
diff --git a/sys/man/4/factotum b/sys/man/4/factotum
index 9ca736072..d6ee5e3a1 100644
--- a/sys/man/4/factotum
+++ b/sys/man/4/factotum
@@ -741,3 +741,16 @@ is the reason for the error.
 .B /sys/src/cmd/auth/factotum
 .SH "SEE ALSO"
 .IR authsrv (6)
+.SH "HISTORY"
+Since November 2024,
+.I auth/factotum
+understand the previously ignored
+mount specifier
+.BR factotum ,
+causing it to serve the second-level directory
+as the root of the file-system.
+This allows directly mounting it on
+.BR /mnt/factotum ,
+avoiding the need to respond to walks
+passing over
+.BR /mnt .
diff --git a/sys/src/cmd/auth/factotum/fs.c b/sys/src/cmd/auth/factotum/fs.c
index 552b504de..6926e633e 100644
--- a/sys/src/cmd/auth/factotum/fs.c
+++ b/sys/src/cmd/auth/factotum/fs.c
@@ -7,7 +7,7 @@ int		doprivate = 1;
 int		gflag;
 char		*owner;
 int		kflag;
-char		*mtpt = "/mnt";
+char		*mtpt = nil;
 Keyring	*ring;
 char		*service;
 int		sflag;
@@ -153,7 +153,12 @@ main(int argc, char **argv)
 		promptforhostowner();
 	owner = getuser();
 
-	postmountsrv(&fs, service, mtpt, MBEFORE);
+	if(mtpt == nil){
+		mtpt = "/mnt";
+		mount(postsrv(&fs, service), -1, "/mnt/factotum", MREPL, "factotum");
+	} else {
+		mount(postsrv(&fs, service), -1, mtpt, MBEFORE, "");
+	}
 	if(service){
 		nulldir(&d);
 		d.mode = 0666;
@@ -236,7 +241,14 @@ mkqid(int type, int path)
 static void
 fsattach(Req *r)
 {
-	r->fid->qid = mkqid(QTDIR, Qroot);
+	if(strcmp(r->ifcall.aname, "factotum") == 0)
+		r->fid->qid = mkqid(QTDIR, Qfactotum);
+	else if(*r->ifcall.aname == 0)
+		r->fid->qid = mkqid(QTDIR, Qroot);
+	else {
+		respond(r, "unknown mount spec");
+		return;
+	}
 	r->ofcall.qid = r->fid->qid;
 	respond(r, nil);
 }