diff --git a/bin/prod/get-recore-serial-number b/bin/prod/get-recore-serial-number
index 407dc90..be14bc9 100755
--- a/bin/prod/get-recore-serial-number
+++ b/bin/prod/get-recore-serial-number
@@ -5,5 +5,10 @@ set -euo pipefail
 CONFIG_DIR="${REFLASH_CONFIG_DIR:-/mnt/config}"
 
 mount-config
+# A board with no serial number provisioned yet - the exact case this
+# script exists to detect - means serial_number doesn't exist, so cat
+# fails and set -e exits before reaching unmount-config, leaving the
+# mount (and its transient systemd unit) dangling. Make the unmount
+# unconditional instead.
+trap unmount-config EXIT
 cat "$CONFIG_DIR/serial_number"
-unmount-config
diff --git a/test/bats/getters.bats b/test/bats/getters.bats
index 77c3766..ad3766d 100644
--- a/test/bats/getters.bats
+++ b/test/bats/getters.bats
@@ -27,3 +27,15 @@ teardown() { teardown_sandbox; }
   [ "$status" -eq 0 ]
   [ "$output" = "RC-0001-XYZ" ]
 }
+
+@test "get-recore-serial-number: still unmounts when serial_number is missing (#83 fallout)" {
+  export REFLASH_CONFIG_DIR="$SANDBOX/config"
+  mkdir -p "$REFLASH_CONFIG_DIR"
+  # No serial_number file - this is exactly the state a not-yet-provisioned
+  # board is in, i.e. the case this script exists to detect.
+  stub_silent mount-config
+  stub_silent unmount-config
+  run "$PROD_BIN/get-recore-serial-number"
+  [ "$status" -ne 0 ]
+  assert_called_with "unmount-config"
+}