diff --git a/internal/cryptsetup/cryptsetup.go b/internal/cryptsetup/cryptsetup.go
index 13c1e6e..73621ca 100644
--- a/internal/cryptsetup/cryptsetup.go
+++ b/internal/cryptsetup/cryptsetup.go
@@ -64,7 +64,8 @@ func Mount(devicePath, mountpoint string) (string, error) {
 	return mountpoint, nil
 }
 
-// Unmount unmounts the given mountpoint using privileged umount.
+// Unmount unmounts the given mountpoint using privileged umount, then
+// removes the mount directory if it is empty.
 func Unmount(mountpoint string) error {
 	args := withPrivilege([]string{"umount", mountpoint})
 	cmd := exec.Command(args[0], args[1:]...)
@@ -73,6 +74,12 @@ func Unmount(mountpoint string) error {
 	if err := cmd.Run(); err != nil {
 		return fmt.Errorf("umount %s: %w", mountpoint, err)
 	}
+
+	// Clean up empty mount directory. Best-effort — ignore errors
+	// (directory may not be empty or may be a system path).
+	rmdirArgs := withPrivilege([]string{"rmdir", mountpoint})
+	exec.Command(rmdirArgs[0], rmdirArgs[1:]...).Run()
+
 	return nil
 }