diff --git a/pkg/daemon/daemon.go b/pkg/daemon/daemon.go
index d5708ac77c..432737098f 100644
--- a/pkg/daemon/daemon.go
+++ b/pkg/daemon/daemon.go
@@ -1400,10 +1400,6 @@ func (dn *Daemon) checkStateOnFirstRun() error {
 		return fmt.Errorf("error detecting previous SSH accesses: %w", err)
 	}
 
-	if err := dn.removeRollback(); err != nil {
-		return fmt.Errorf("Failed to remove rollback: %w", err)
-	}
-
 	// Bootstrapping state is when we have the node annotations file
 	if state.bootstrapping {
 		targetOSImageURL := state.currentConfig.Spec.OSImageURL
diff --git a/pkg/daemon/rpm-ostree.go b/pkg/daemon/rpm-ostree.go
index 023e1286c5..e436097100 100644
--- a/pkg/daemon/rpm-ostree.go
+++ b/pkg/daemon/rpm-ostree.go
@@ -63,6 +63,7 @@ type NodeUpdaterClient interface {
 	Initialize() error
 	GetStatus() (string, error)
 	GetBootedOSImageURL() (string, string, error)
+	CleanupRollback() error
 	Rebase(string, string) (bool, error)
 	GetBootedDeployment() (*RpmOstreeDeployment, error)
 }
@@ -162,6 +163,16 @@ func (r *RpmOstreeClient) GetStatus() (string, error) {
 	return string(output), nil
 }
 
+// CleanupRollback removes the rpm-ostree rollback deployment.
+// It takes up space and can cause issues when /boot contains multiple
+// initramfs images: https://bugzilla.redhat.com/show_bug.cgi?id=2104619.
+// We don't generally expect administrators to use this versus e.g. removing
+// broken configuration. We only remove the rollback once the MCD pod has
+// landed on a node, so we know kubelet is working.
+func (r *RpmOstreeClient) CleanupRollback() error {
+	return runRpmOstree("cleanup", "-r")
+}
+
 // GetBootedOSImageURL returns the image URL as well as the OSTree version (for logging)
 // Returns the empty string if the host doesn't have a custom origin that matches pivot://
 // (This could be the case for e.g. FCOS, or a future RHCOS which comes not-pivoted by default)
diff --git a/pkg/daemon/rpm-ostree_test.go b/pkg/daemon/rpm-ostree_test.go
index 6159d3d2bf..6e311a173c 100644
--- a/pkg/daemon/rpm-ostree_test.go
+++ b/pkg/daemon/rpm-ostree_test.go
@@ -43,6 +43,10 @@ func (r RpmOstreeClientMock) GetStatus() (string, error) {
 	return "rpm-ostree mock: blah blah some status here", nil
 }
 
+func (r RpmOstreeClientMock) CleanupRollback() error {
+	return nil
+}
+
 func (r RpmOstreeClientMock) GetBootedDeployment() (*RpmOstreeDeployment, error) {
 	return &RpmOstreeDeployment{}, nil
 }
diff --git a/pkg/daemon/update.go b/pkg/daemon/update.go
index 1deef2a1a8..ee8552542f 100644
--- a/pkg/daemon/update.go
+++ b/pkg/daemon/update.go
@@ -372,6 +372,9 @@ func (dn *CoreOSDaemon) applyOSChanges(mcDiff machineConfigDiff, oldConfig, newC
 
 	// Update OS
 	if mcDiff.osUpdate {
+		if err := dn.NodeUpdaterClient.CleanupRollback(); err != nil {
+			return err
+		}
 		if err := updateOS(newConfig, osImageContentDir); err != nil {
 			nodeName := ""
 			if dn.node != nil {
@@ -720,20 +723,6 @@ func (dn *Daemon) updateHypershift(oldConfig, newConfig *mcfgv1.MachineConfig, d
 	return nil
 }
 
-// removeRollback removes the rpm-ostree rollback deployment.
-// It takes up space and can cause issues when /boot contains multiple
-// initramfs images: https://bugzilla.redhat.com/show_bug.cgi?id=2104619.
-// We don't generally expect administrators to use this versus e.g. removing
-// broken configuration. We only remove the rollback once the MCD pod has
-// landed on a node, so we know kubelet is working.
-func (dn *Daemon) removeRollback() error {
-	if !dn.os.IsCoreOSVariant() {
-		// do not attempt to rollback on non-RHCOS/FCOS machines
-		return nil
-	}
-	return runRpmOstree("cleanup", "-r")
-}
-
 // machineConfigDiff represents an ad-hoc difference between two MachineConfig objects.
 // At some point this may change into holding just the files/units that changed
 // and the MCO would just operate on that.  For now we're just doing this to get