diff --git a/Makefile.am b/Makefile.am
index a74c62d..ccbadce 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -35,10 +35,12 @@ install-data-local:
 	$(LN_S) $(TEMPLATEDIR)/sync $(DESTDIR)$(SVCDIR)/sync@shutdown
 	$(LN_S) $(TEMPLATEDIR)/sigkill $(DESTDIR)$(SVCDIR)/sigkill@shutdown
 	$(LN_S) $(TEMPLATEDIR)/sigterm $(DESTDIR)$(SVCDIR)/sigterm@shutdown
+	$(LN_S) $(TEMPLATEDIR)/unmount $(DESTDIR)$(SVCDIR)/unmount@shutdown
 	$(LN_S) $(TEMPLATEDIR)/sync $(DESTDIR)$(SVCDIR)/sync@reboot
 	$(LN_S) $(TEMPLATEDIR)/sigkill $(DESTDIR)$(SVCDIR)/sigkill@reboot
 	$(LN_S) $(TEMPLATEDIR)/sigterm $(DESTDIR)$(SVCDIR)/sigterm@reboot
 	$(LN_S) $(TEMPLATEDIR)/ifdown $(DESTDIR)$(SVCDIR)/ifdown@reboot
+	$(LN_S) $(TEMPLATEDIR)/unmount $(DESTDIR)$(SVCDIR)/unmount@reboot
 	$(LN_S) $(TEMPLATEDIR)/ifcfg $(DESTDIR)$(SVCDIR)/ifcfg
 	$(LN_S) $(TEMPLATEDIR)/modules $(DESTDIR)$(SVCDIR)/modules
 	$(LN_S) $(TEMPLATEDIR)/network $(DESTDIR)$(SVCDIR)/network
diff --git a/docs/defconfig.md b/docs/defconfig.md
index c58848e..c4ab477 100644
--- a/docs/defconfig.md
+++ b/docs/defconfig.md
@@ -90,6 +90,8 @@ For the shutdown and reboot targets, the following services are executed:
  * sigterm - send the SIGTERM signal to all processes and wait for 5 seconds
  * sigkill - send the SIGKILL signal to all remaining processes
  * ifdown - bring all network interfaces down
+ * unmount - unmount the overlay mount points and the underlying
+   writeable filesystem
  * sync - run the sync command
 
 
diff --git a/services/Makemodule.am b/services/Makemodule.am
index 8bd2bb1..84904fb 100644
--- a/services/Makemodule.am
+++ b/services/Makemodule.am
@@ -8,7 +8,7 @@ init_DATA += services/unbound services/dnsmasq services/ifdown services/modules
 init_DATA += services/network services/hostapd services/nft services/sigkill
 init_DATA += services/sshd services/sshd_keygen services/consolefont
 init_DATA += services/nginx services/usyslogd services/klogd
-init_DATA += services/gcrond services/mountusr
+init_DATA += services/gcrond services/mountusr services/unmount
 init_DATA += services/tmpfsrun services/tmpfsvar
 
 if DHCPCLIENT
@@ -24,4 +24,4 @@ EXTRA_DIST += services/sync services/sysctl services/tmpfs
 EXTRA_DIST += services/dhcpcdmaster services/unbound
 EXTRA_DIST += services/usyslogd services/dnsmasq services/network
 EXTRA_DIST += services/consolefont services/gcrond services/nginx
-EXTRA_DIST += services/tmpfsrun
+EXTRA_DIST += services/tmpfsrun services/unmount
diff --git a/services/ifdown.in b/services/ifdown.in
index 1310098..2946ca0 100644
--- a/services/ifdown.in
+++ b/services/ifdown.in
@@ -2,6 +2,6 @@ description "stop all network interfaces"
 type wait
 target %0
 after sigkill sigterm
-before sync
+before sync unmount
 
 exec "@SCRIPTDIR@/ifdown.sh"
\ No newline at end of file
diff --git a/services/unmount b/services/unmount
new file mode 100644
index 0000000..6574c8d
--- /dev/null
+++ b/services/unmount
@@ -0,0 +1,9 @@
+description unmount overlay filesystem
+type wait
+target %0
+after sigkill
+before sync
+exec {
+	umount -nli /var/lib /usr /etc
+	umount -nli /cfg/overlay
+}