diff --git a/internal/fusefrontend/node.go b/internal/fusefrontend/node.go
index 6f85ddb..ee2d8d9 100644
--- a/internal/fusefrontend/node.go
+++ b/internal/fusefrontend/node.go
@@ -364,7 +364,7 @@ func (n *Node) Link(ctx context.Context, target fs.InodeEmbedder, name string, o
 	}
 	defer syscall.Close(dirfd)
 
-	n2 := target.(*Node)
+	n2 := toNode(target)
 	dirfd2, cName2, errno := n2.prepareAtSyscall("")
 	if errno != 0 {
 		return
@@ -462,7 +462,7 @@ func (n *Node) Rename(ctx context.Context, name string, newParent fs.InodeEmbedd
 	}
 	defer syscall.Close(dirfd)
 
-	n2 := newParent.(*Node)
+	n2 := toNode(newParent)
 	dirfd2, cName2, errno := n2.prepareAtSyscall("")
 	if errno != 0 {
 		return
diff --git a/internal/fusefrontend/node_dir_ops.go b/internal/fusefrontend/node_dir_ops.go
index df8f060..5cf58ea 100644
--- a/internal/fusefrontend/node_dir_ops.go
+++ b/internal/fusefrontend/node_dir_ops.go
@@ -350,7 +350,7 @@ func (n *Node) Opendir(ctx context.Context) (errno syscall.Errno) {
 	defer syscall.Close(dirfd)
 
 	// Open backing directory
-	fd, err := syscallcompat.Openat(dirfd, cName, syscall.O_RDONLY|syscall.O_DIRECTORY, 0)
+	fd, err := syscallcompat.Openat(dirfd, cName, syscall.O_RDONLY|syscall.O_DIRECTORY|syscall.O_NOFOLLOW, 0)
 	if err != nil {
 		return fs.ToErrno(err)
 	}
diff --git a/internal/fusefrontend/node_helpers.go b/internal/fusefrontend/node_helpers.go
index 1eb6d4a..a7a32af 100644
--- a/internal/fusefrontend/node_helpers.go
+++ b/internal/fusefrontend/node_helpers.go
@@ -3,6 +3,8 @@ package fusefrontend
 import (
 	"context"
 
+	"github.com/hanwen/go-fuse/v2/fs"
+
 	"github.com/hanwen/go-fuse/v2/fuse"
 )
 
@@ -18,3 +20,12 @@ func toFuseCtx(ctx context.Context) (ctx2 *fuse.Context) {
 	}
 	return ctx2
 }
+
+// toNode casts a generic fs.InodeEmbedder into *Node. Also handles *RootNode
+// by return rn.Node.
+func toNode(op fs.InodeEmbedder) *Node {
+	if r, ok := op.(*RootNode); ok {
+		return &r.Node
+	}
+	return op.(*Node)
+}