diff --git a/profiles/apparmor.d/fusermount3 b/profiles/apparmor.d/fusermount3
index c45ff422f..f159a1b31 100644
--- a/profiles/apparmor.d/fusermount3
+++ b/profiles/apparmor.d/fusermount3
@@ -10,17 +10,13 @@ profile fusermount3 /usr/bin/fusermount3 {
   capability dac_read_search,
 
   # Allow both rw and ro type mounts (e.g. AppImage uses ro)
-  mount fstype=@{fuse_types} options=(nosuid,nodev,rw) -> @{HOME}/**/,
-  mount fstype=@{fuse_types} options=(nosuid,nodev,rw) -> /mnt/{,**/},
-  mount fstype=@{fuse_types} options=(nosuid,nodev,rw) -> @{run}/user/@{uid}/**/,
-  mount fstype=@{fuse_types} options=(nosuid,nodev,rw) -> /media/**/,
-  mount fstype=@{fuse_types} options=(nosuid,nodev,rw) -> /tmp/**/,
- 
-  mount fstype=@{fuse_types} options=(nosuid,nodev,ro) -> @{HOME}/**/,
-  mount fstype=@{fuse_types} options=(nosuid,nodev,ro) -> /mnt/{,**/},
-  mount fstype=@{fuse_types} options=(nosuid,nodev,ro) -> @{run}/user/@{uid}/**/,
-  mount fstype=@{fuse_types} options=(nosuid,nodev,ro) -> /media/**/,
-  mount fstype=@{fuse_types} options=(nosuid,nodev,ro) -> /tmp/**/,
+  #MS_DIRSYNC, MS_NOATIME, MS_NODIRATIME, MS_NOEXEC, MS_SYNCHRONOUS, MS_NOSYMFOLLOW
+  mount fstype=@{fuse_types} options=(nosuid,nodev) options in (ro,rw,noatime,dirsync,nodiratime,sync) -> @{HOME}/**/,
+  mount fstype=@{fuse_types} options=(nosuid,nodev) options in (ro,rw,noatime,dirsync,nodiratime,sync) -> /mnt/{,**/},
+  mount fstype=@{fuse_types} options=(nosuid,nodev) options in (ro,rw,noatime,dirsync,nodiratime,sync) -> @{run}/user/@{uid}/**/,
+  mount fstype=@{fuse_types} options=(nosuid,nodev) options in (ro,rw,noatime,dirsync,nodiratime,sync) -> /media/**/,
+  mount fstype=@{fuse_types} options=(nosuid,nodev) options in (ro,rw,noatime,dirsync,nodiratime,sync) -> /tmp/**/,
+  # Cern VM fs is special and only uses these exact flags
   mount fstype=@{fuse_types} options=(nosuid,nodev,ro) -> /cvmfs/**/,
 
   umount @{HOME}/**/,