diff --git a/isar-patches/0001-image-Avoid-breaking-the-build-when-mounts-are-no-lo.patch b/isar-patches/0001-image-Avoid-breaking-the-build-when-mounts-are-no-lo.patch
new file mode 100644
index 00000000..8e650445
--- /dev/null
+++ b/isar-patches/0001-image-Avoid-breaking-the-build-when-mounts-are-no-lo.patch
@@ -0,0 +1,64 @@
+From 84fdccc3223d31bded29dd5adf86948f6cf83e81 Mon Sep 17 00:00:00 2001
+From: Jan Kiszka <jan.kiszka@siemens.com>
+Date: Tue, 1 Oct 2024 16:52:26 +0200
+Subject: [PATCH 1/4] image: Avoid breaking the build when mounts are no longer
+ present on umount
+
+This does not seem to trigger yet because we always have those
+mountpoints present. But if that is no longer the case, we will bail out
+when mountpoint fails due to the set -e.
+
+Fixes: 165519a7b314 ("sudo: Fail on the first error")
+Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
+---
+ meta/classes/image.bbclass | 25 ++++++++++++++++---------
+ 1 file changed, 16 insertions(+), 9 deletions(-)
+
+diff --git a/meta/classes/image.bbclass b/meta/classes/image.bbclass
+index 0c162aa3..9d5b782a 100644
+--- a/meta/classes/image.bbclass
++++ b/meta/classes/image.bbclass
+@@ -418,24 +418,31 @@ do_rootfs_finalize() {
+                 -maxdepth 1 -name 'qemu-*-static' -type f -delete
+         fi
+ 
+-        mountpoint -q '${ROOTFSDIR}/isar-apt' && \
+-            umount '${ROOTFSDIR}/isar-apt' && \
++        if mountpoint -q '${ROOTFSDIR}/isar-apt'; then
++            umount '${ROOTFSDIR}/isar-apt'
+             rmdir --ignore-fail-on-non-empty ${ROOTFSDIR}/isar-apt
++        fi
+ 
+-        mountpoint -q '${ROOTFSDIR}/base-apt' && \
+-            umount '${ROOTFSDIR}/base-apt' && \
++        if mountpoint -q '${ROOTFSDIR}/base-apt'; then
++            umount '${ROOTFSDIR}/base-apt'
+             rmdir --ignore-fail-on-non-empty ${ROOTFSDIR}/base-apt
++        fi
+ 
+-        mountpoint -q '${ROOTFSDIR}/dev/pts' && \
++        if mountpoint -q '${ROOTFSDIR}/dev/pts'; then
+             umount '${ROOTFSDIR}/dev/pts'
+-        mountpoint -q '${ROOTFSDIR}/dev/shm' && \
++        fi
++        if mountpoint -q '${ROOTFSDIR}/dev/shm'; then
+             umount '${ROOTFSDIR}/dev/shm'
+-        mountpoint -q '${ROOTFSDIR}/dev' && \
++        fi
++        if mountpoint -q '${ROOTFSDIR}/dev'; then
+             umount '${ROOTFSDIR}/dev'
+-        mountpoint -q '${ROOTFSDIR}/proc' && \
++        fi
++        if mountpoint -q '${ROOTFSDIR}/proc'; then
+             umount '${ROOTFSDIR}/proc'
+-        mountpoint -q '${ROOTFSDIR}/sys' && \
++        fi
++        if mountpoint -q '${ROOTFSDIR}/sys'; then
+             umount '${ROOTFSDIR}/sys'
++        fi
+ 
+         if [ -e "${ROOTFSDIR}/etc/apt/sources-list" ]; then
+             mv "${ROOTFSDIR}/etc/apt/sources-list" \
+-- 
+2.43.0
+
diff --git a/isar-patches/0002-rootfs-Provide-rootfs_do_umounts.patch b/isar-patches/0002-rootfs-Provide-rootfs_do_umounts.patch
new file mode 100644
index 00000000..6ac2af36
--- /dev/null
+++ b/isar-patches/0002-rootfs-Provide-rootfs_do_umounts.patch
@@ -0,0 +1,105 @@
+From 79155ddf156e073a98315bf2f35f7ca0f5ba3a77 Mon Sep 17 00:00:00 2001
+From: Jan Kiszka <jan.kiszka@siemens.com>
+Date: Tue, 1 Oct 2024 17:08:24 +0200
+Subject: [PATCH 2/4] rootfs: Provide rootfs_do_umounts
+
+This will be used more frequently soon to avoid dangling mounts.
+
+Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
+---
+ meta/classes/image.bbclass  | 28 ++--------------------------
+ meta/classes/rootfs.bbclass | 32 ++++++++++++++++++++++++++++++++
+ 2 files changed, 34 insertions(+), 26 deletions(-)
+
+diff --git a/meta/classes/image.bbclass b/meta/classes/image.bbclass
+index 9d5b782a..1eb974e8 100644
+--- a/meta/classes/image.bbclass
++++ b/meta/classes/image.bbclass
+@@ -405,6 +405,8 @@ def apt_list_files(d):
+ IMAGE_LISTS = "${@ ' '.join(apt_list_files(d)) }"
+ 
+ do_rootfs_finalize() {
++    rootfs_do_umounts
++
+     sudo -s <<'EOSUDO'
+         set -e
+ 
+@@ -418,32 +420,6 @@ do_rootfs_finalize() {
+                 -maxdepth 1 -name 'qemu-*-static' -type f -delete
+         fi
+ 
+-        if mountpoint -q '${ROOTFSDIR}/isar-apt'; then
+-            umount '${ROOTFSDIR}/isar-apt'
+-            rmdir --ignore-fail-on-non-empty ${ROOTFSDIR}/isar-apt
+-        fi
+-
+-        if mountpoint -q '${ROOTFSDIR}/base-apt'; then
+-            umount '${ROOTFSDIR}/base-apt'
+-            rmdir --ignore-fail-on-non-empty ${ROOTFSDIR}/base-apt
+-        fi
+-
+-        if mountpoint -q '${ROOTFSDIR}/dev/pts'; then
+-            umount '${ROOTFSDIR}/dev/pts'
+-        fi
+-        if mountpoint -q '${ROOTFSDIR}/dev/shm'; then
+-            umount '${ROOTFSDIR}/dev/shm'
+-        fi
+-        if mountpoint -q '${ROOTFSDIR}/dev'; then
+-            umount '${ROOTFSDIR}/dev'
+-        fi
+-        if mountpoint -q '${ROOTFSDIR}/proc'; then
+-            umount '${ROOTFSDIR}/proc'
+-        fi
+-        if mountpoint -q '${ROOTFSDIR}/sys'; then
+-            umount '${ROOTFSDIR}/sys'
+-        fi
+-
+         if [ -e "${ROOTFSDIR}/etc/apt/sources-list" ]; then
+             mv "${ROOTFSDIR}/etc/apt/sources-list" \
+                 "${ROOTFSDIR}/etc/apt/sources.list.d/bootstrap.list"
+diff --git a/meta/classes/rootfs.bbclass b/meta/classes/rootfs.bbclass
+index f0abd795..ef40cbdf 100644
+--- a/meta/classes/rootfs.bbclass
++++ b/meta/classes/rootfs.bbclass
+@@ -65,6 +65,38 @@ rootfs_do_mounts() {
+ EOSUDO
+ }
+ 
++rootfs_do_umounts() {
++    sudo -s <<'EOSUDO'
++        set -e
++        if mountpoint -q '${ROOTFSDIR}/isar-apt'; then
++            umount '${ROOTFSDIR}/isar-apt'
++            rmdir --ignore-fail-on-non-empty ${ROOTFSDIR}/isar-apt
++        fi
++
++        if mountpoint -q '${ROOTFSDIR}/base-apt'; then
++            umount '${ROOTFSDIR}/base-apt'
++            rmdir --ignore-fail-on-non-empty ${ROOTFSDIR}/base-apt
++        fi
++
++        if mountpoint -q '${ROOTFSDIR}/dev/pts'; then
++            umount '${ROOTFSDIR}/dev/pts'
++        fi
++        if mountpoint -q '${ROOTFSDIR}/dev/shm'; then
++            umount '${ROOTFSDIR}/dev/shm'
++        fi
++        if mountpoint -q '${ROOTFSDIR}/dev'; then
++            umount '${ROOTFSDIR}/dev'
++        fi
++        if mountpoint -q '${ROOTFSDIR}/proc'; then
++            umount '${ROOTFSDIR}/proc'
++        fi
++        if mountpoint -q '${ROOTFSDIR}/sys'; then
++            umount '${ROOTFSDIR}/sys'
++        fi
++
++EOSUDO
++}
++
+ rootfs_do_qemu() {
+     if [ '${@repr(d.getVar('ROOTFS_ARCH') == d.getVar('HOST_ARCH'))}' = 'False' ]
+     then
+-- 
+2.43.0
+
diff --git a/isar-patches/0003-initramfs-Add-missing-umounts-after-generation.patch b/isar-patches/0003-initramfs-Add-missing-umounts-after-generation.patch
new file mode 100644
index 00000000..0f2770aa
--- /dev/null
+++ b/isar-patches/0003-initramfs-Add-missing-umounts-after-generation.patch
@@ -0,0 +1,29 @@
+From 78e8ecbaab9dcf887e46e52d220647ad838b4d4b Mon Sep 17 00:00:00 2001
+From: Jan Kiszka <jan.kiszka@siemens.com>
+Date: Mon, 30 Sep 2024 20:46:50 +0200
+Subject: [PATCH 3/4] initramfs: Add missing umounts after generation
+
+Failing to unmount what was mounted via rootfs_do_mounts can cause
+troubles on rebuilds.
+
+Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
+---
+ meta/classes/initramfs.bbclass | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/meta/classes/initramfs.bbclass b/meta/classes/initramfs.bbclass
+index 6886b95a..42013356 100644
+--- a/meta/classes/initramfs.bbclass
++++ b/meta/classes/initramfs.bbclass
+@@ -45,6 +45,8 @@ do_generate_initramfs() {
+           update-initramfs -u -v ;  \
+         fi'
+ 
++    rootfs_do_umounts
++
+     if [ ! -e "${INITRAMFS_ROOTFS}/initrd.img" ]; then
+         bberror "No initramfs was found after generation!"
+     fi
+-- 
+2.43.0
+
diff --git a/isar-patches/0004-rootfs-Add-missing-umounts-in-rootfs_postprocess-and.patch b/isar-patches/0004-rootfs-Add-missing-umounts-in-rootfs_postprocess-and.patch
new file mode 100644
index 00000000..2f6b9d09
--- /dev/null
+++ b/isar-patches/0004-rootfs-Add-missing-umounts-in-rootfs_postprocess-and.patch
@@ -0,0 +1,74 @@
+From 55d8292d600e1d29fdf3f7eecc36f7c2ad6b0671 Mon Sep 17 00:00:00 2001
+From: Florian Bezdeka <florian.bezdeka@siemens.com>
+Date: Wed, 2 Oct 2024 22:31:55 +0200
+Subject: [PATCH 4/4] rootfs: Add missing umounts in rootfs_postprocess() and
+ rootfs_install()
+
+Calls to rootfs_do_mounts should always be paired with calls to
+rootfs_do_umounts.
+
+In case there was an exception thrown within the try blocks they will be
+re-raised after the finally block has been processed. This way we try to
+avoid leaking mounts but unmounting might still fail. In any case we
+tried our best to clean up.
+
+Signed-off-by: Florian Bezdeka <florian.bezdeka@siemens.com>
+---
+ meta/classes/rootfs.bbclass | 31 +++++++++++++++++++------------
+ 1 file changed, 19 insertions(+), 12 deletions(-)
+
+diff --git a/meta/classes/rootfs.bbclass b/meta/classes/rootfs.bbclass
+index ef40cbdf..c7011508 100644
+--- a/meta/classes/rootfs.bbclass
++++ b/meta/classes/rootfs.bbclass
+@@ -248,18 +248,21 @@ python do_rootfs_install() {
+     progress_reporter = bb.progress.MultiStageProgressReporter(d, stage_weights)
+     d.rootfs_progress = progress_reporter
+ 
+-    for cmd in cmds:
+-        progress_reporter.next_stage()
++    try:
++        for cmd in cmds:
++            progress_reporter.next_stage()
+ 
+-        if (d.getVarFlag(cmd, 'isar-apt-lock') or "") == "acquire-before":
+-            lock = bb.utils.lockfile(d.getVar("REPO_ISAR_DIR") + "/isar.lock",
+-                                     shared=True)
++            if (d.getVarFlag(cmd, 'isar-apt-lock') or "") == "acquire-before":
++                lock = bb.utils.lockfile(d.getVar("REPO_ISAR_DIR") + "/isar.lock",
++                                         shared=True)
+ 
+-        bb.build.exec_func(cmd, d)
++            bb.build.exec_func(cmd, d)
+ 
+-        if (d.getVarFlag(cmd, 'isar-apt-lock') or "") == "release-after":
+-            bb.utils.unlockfile(lock)
+-    progress_reporter.finish()
++            if (d.getVarFlag(cmd, 'isar-apt-lock') or "") == "release-after":
++                bb.utils.unlockfile(lock)
++            progress_reporter.finish()
++    finally:
++        bb.build.exec_func('rootfs_do_umounts', d)
+ }
+ addtask rootfs_install before do_rootfs_postprocess after do_unpack
+ 
+@@ -379,9 +382,13 @@ python do_rootfs_postprocess() {
+     if cmds is None or not cmds.strip():
+         return
+     cmds = cmds.split()
+-    for i, cmd in enumerate(cmds):
+-        bb.build.exec_func(cmd, d)
+-        progress_reporter.update(int(i / len(cmds) * 100))
++
++    try:
++        for i, cmd in enumerate(cmds):
++            bb.build.exec_func(cmd, d)
++            progress_reporter.update(int(i / len(cmds) * 100))
++    finally:
++        bb.build.exec_func('rootfs_do_umounts', d)
+ }
+ addtask rootfs_postprocess before do_rootfs after do_unpack
+ 
+-- 
+2.43.0
+
diff --git a/kas-cip.yml b/kas-cip.yml
index f00ad74c..7e9ece38 100644
--- a/kas-cip.yml
+++ b/kas-cip.yml
@@ -17,12 +17,26 @@ target: cip-core-image
 
 build_system: isar
 
+defaults:
+  repos:
+    patches:
+      repo: cip-core
+
 repos:
   cip-core:
 
   isar:
     url: https://github.com/ilbers/isar.git
-    commit: d2d3b3e94874d62d48c0cafb99dfffde6afbc6ce
+    commit: 36b04737a07baafc5af64cdc8aa61fad13fb494a
+    patches:
+      01:
+        path: isar-patches/0001-image-Avoid-breaking-the-build-when-mounts-are-no-lo.patch
+      02:
+        path: isar-patches/0002-rootfs-Provide-rootfs_do_umounts.patch
+      03:
+        path: isar-patches/0003-initramfs-Add-missing-umounts-after-generation.patch
+      04:
+        path: isar-patches/0004-rootfs-Add-missing-umounts-in-rootfs_postprocess-and.patch
     layers:
       meta:
 
