Using mkosi boot with read-only root and writable /var

[DCKcode]

I've been trying to use mkosi to build an OS image that is read only. When I use mkosi boot to test it, by default it will use a read/write rootfs. To properly test it as a read-only image with mkosi boot, I added this mkosi.nspawn file to my project:

[Files]
ReadOnly=true

This seems to work great, and the image boots with a read-only file system. Of course systemd doesn't work great on a system where everything is read-only, so I want to make /var writable for its state files and logs. Looking at the nspawn documentation, this should be as easy as editing my mkosi.nspawn to be:

[Files]
ReadOnly=true
Bind=/runtime/var:/var

However, when I invoke mkosi boot with this configuration, the Bind= configuration does not appear to be picked up. The system boots as read only, but /var remains read only and is not mounted from the host directory. In fact, any directory I'm trying to bind mount in the host does not appear to work. I've tried changing the location or removing the read only flag.

Am I doing this wrong, or is there a bug here? Is there another way to get a read-only rootfs with writable /var working with mkosi boot? I'm using mkosi 25.3 and Fedora 42.