diff --git a/bootstrap/src/aarch64.ld b/bootstrap/src/aarch64.ld
index cee830f08a..4a0804b8c2 100644
--- a/bootstrap/src/aarch64.ld
+++ b/bootstrap/src/aarch64.ld
@@ -16,6 +16,15 @@ SECTIONS {
   .rodata : {
     __rodata_start = .;
     *(.rodata*)
+  }
+  .data.rel.ro : {
+    *(.data.rel.ro*)
+  }
+  .got : {
+    *(.got)
+  }
+  .got.plt : {
+    *(.got.plt)
     . = ALIGN(4096);
     __rodata_end = .;
   }
diff --git a/bootstrap/src/exec.rs b/bootstrap/src/exec.rs
index bed91a03a9..24df729806 100644
--- a/bootstrap/src/exec.rs
+++ b/bootstrap/src/exec.rs
@@ -117,10 +117,16 @@ pub fn main() -> ! {
     unsafe extern "C" {
         // The linker script will define this as the location of the initfs header.
         static __initfs_header: u8;
+
+        // The linker script will define this as the end of the executable (excluding initfs).
+        static __bss_end: u8;
     }
 
+    let initfs_start = core::ptr::addr_of!(__initfs_header);
     let initfs_length = unsafe {
-        (*(core::ptr::addr_of!(__initfs_header) as *const redox_initfs::types::Header)).initfs_size
+        (*(core::ptr::addr_of!(__initfs_header) as *const redox_initfs::types::Header))
+            .initfs_size
+            .get() as usize
     };
 
     let (scheme_creation_cap, auth, kernel_schemes, initfs_fd) = spawn(
@@ -131,11 +137,6 @@ pub fn main() -> ! {
         kernel_schemes,
         false,
         |write_fd, socket, _, _| unsafe {
-            // Creating a reference to NULL is UB. Mask the UB for now using black_box.
-            // FIXME use a raw pointer and inline asm for reading instead for the initfs header.
-            let initfs_start = core::ptr::addr_of!(__initfs_header);
-            let initfs_length = initfs_length.get() as usize;
-
             crate::initfs::run(
                 core::slice::from_raw_parts(initfs_start, initfs_length),
                 write_fd,
@@ -144,6 +145,18 @@ pub fn main() -> ! {
         },
     );
 
+    // Unmap initfs data as only the initfs scheme implementation needs it.
+    unsafe {
+        let executable_end = core::ptr::addr_of!(__bss_end)
+            .add(core::ptr::addr_of!(__bss_end).align_offset(syscall::PAGE_SIZE));
+        syscall::funmap(
+            executable_end as usize,
+            initfs_length.next_multiple_of(syscall::PAGE_SIZE)
+                - (executable_end.offset_from(initfs_start) as usize),
+        )
+        .unwrap();
+    }
+
     let (scheme_creation_cap, auth, kernel_schemes, proc_fd) = spawn(
         "process manager",
         auth,
diff --git a/bootstrap/src/i586.ld b/bootstrap/src/i586.ld
index 9bfb676b6b..f53877f039 100644
--- a/bootstrap/src/i586.ld
+++ b/bootstrap/src/i586.ld
@@ -16,6 +16,15 @@ SECTIONS {
   .rodata : {
     __rodata_start = .;
     *(.rodata*)
+  }
+  .data.rel.ro : {
+    *(.data.rel.ro*)
+  }
+  .got : {
+    *(.got)
+  }
+  .got.plt : {
+    *(.got.plt)
     . = ALIGN(4096);
     __rodata_end = .;
   }
diff --git a/bootstrap/src/i686.ld b/bootstrap/src/i686.ld
index 9bfb676b6b..f53877f039 100644
--- a/bootstrap/src/i686.ld
+++ b/bootstrap/src/i686.ld
@@ -16,6 +16,15 @@ SECTIONS {
   .rodata : {
     __rodata_start = .;
     *(.rodata*)
+  }
+  .data.rel.ro : {
+    *(.data.rel.ro*)
+  }
+  .got : {
+    *(.got)
+  }
+  .got.plt : {
+    *(.got.plt)
     . = ALIGN(4096);
     __rodata_end = .;
   }
diff --git a/bootstrap/src/riscv64.ld b/bootstrap/src/riscv64.ld
index 98b5239bbd..c37274b9f3 100644
--- a/bootstrap/src/riscv64.ld
+++ b/bootstrap/src/riscv64.ld
@@ -16,6 +16,15 @@ SECTIONS {
   .rodata : {
     __rodata_start = .;
     *(.rodata*)
+  }
+  .data.rel.ro : {
+    *(.data.rel.ro*)
+  }
+  .got : {
+    *(.got)
+  }
+  .got.plt : {
+    *(.got.plt)
     . = ALIGN(4096);
     __rodata_end = .;
   }
@@ -23,7 +32,6 @@ SECTIONS {
     __data_start = .;
     *(.data*)
     *(.sdata*)
-    *(.got*)
     . = ALIGN(4096);
     __data_end = .;
 
diff --git a/bootstrap/src/start.rs b/bootstrap/src/start.rs
index e681df452d..14a97ac2ad 100644
--- a/bootstrap/src/start.rs
+++ b/bootstrap/src/start.rs
@@ -82,7 +82,5 @@ pub unsafe extern "C" fn start() -> ! {
         .expect("mprotect failed for rest of memory");
     }
 
-    // FIXME make the initfs read-only
-
     crate::exec::main();
 }
diff --git a/bootstrap/src/x86_64.ld b/bootstrap/src/x86_64.ld
index ecb2094222..375f4acb0d 100644
--- a/bootstrap/src/x86_64.ld
+++ b/bootstrap/src/x86_64.ld
@@ -16,6 +16,15 @@ SECTIONS {
   .rodata : {
     __rodata_start = .;
     *(.rodata*)
+  }
+  .data.rel.ro : {
+    *(.data.rel.ro*)
+  }
+  .got : {
+    *(.got)
+  }
+  .got.plt : {
+    *(.got.plt)
     . = ALIGN(4096);
     __rodata_end = .;
   }