diff --git a/etc/rc b/etc/rc
index 2127d7895925..576ddf937af4 100644
--- a/etc/rc
+++ b/etc/rc
@@ -130,11 +130,17 @@ for _rc_elem in ${files}; do
 done
 
 # Remove the firstboot sentinel, and reboot if it was requested.
+# Be a bit paranoid about removing it to handle the common failure
+# modes since the consequence of failure can be big.
+# Note: this assumes firstboot_sentinel is on / when we have
+# a read-only /, or that it is on media that's writable.
 if [ -e ${firstboot_sentinel} ]; then
 	[ ${root_rw_mount} = "yes" ] || mount -uw /
-	/bin/rm -f ${firstboot_sentinel}
+	chflags -R 0 ${firstboot_sentinel}
+	rm -rf ${firstboot_sentinel}
 	if [ -e ${firstboot_sentinel}-reboot ]; then
-		/bin/rm -f ${firstboot_sentinel}-reboot
+		chflags -R 0 ${firstboot_sentinel}-reboot
+		rm -rf ${firstboot_sentinel}-reboot
 		[ ${root_rw_mount} = "yes" ] || mount -ur /
 		kill -INT 1
 	fi