diff --git a/tests/helpers.bash b/tests/helpers.bash
index ed5de994e..ba2d291f3 100644
--- a/tests/helpers.bash
+++ b/tests/helpers.bash
@@ -296,6 +296,49 @@ function rm() {
     run_unshared rm "$@"
 }
 
+#################
+#  run_with_log  #  Logs command before running it
+#################
+#
+function run_with_log() {
+    local expected_rc=0
+    local retry=1
+    local cmd="$*"
+    case "$1" in
+        [0-9])           expected_rc=$1; shift;;
+        [1-9][0-9])      expected_rc=$1; shift;;
+        [12][0-9][0-9])  expected_rc=$1; shift;;
+        '?')             expected_rc=  ; shift;;  # ignore exit code
+        --retry)         retry=3;        shift;;  # retry with sleep of 1 sec
+    esac
+    while [ $retry -gt 0 ]; do
+        retry=$(( retry - 1 ))
+        echo "$_LOG_PROMPT $cmd"
+        run "$@"
+        echo "$output"
+        if [ "$status" -ne 0 ]; then
+            echo -n "[ rc=$status ";
+            if [ -n "$expected_rc" ]; then
+                if [ "$status" -eq "$expected_rc" ]; then
+                    echo -n "(expected) ";
+                else
+                    echo -n "(** EXPECTED $expected_rc **) ";
+                fi
+            fi
+            echo "]"
+        fi
+        if [ -n "$expected_rc" ]; then
+            if [ "$status" -eq "$expected_rc" ]; then
+                return
+            elif [ $retry -gt 0 ]; then
+                echo "[ RETRYING ]" >&2
+                sleep 1
+            else
+                die "exit code is $status; expected $expected_rc"
+            fi
+        fi
+    done
+}
 
 #################
 #  run_buildah  #  Invoke buildah, with timeout, using BATS 'run'
diff --git a/tests/mkcw.bats b/tests/mkcw.bats
index ed2b47a2c..6309ab6f9 100644
--- a/tests/mkcw.bats
+++ b/tests/mkcw.bats
@@ -22,9 +22,9 @@ function mkcw_check_image() {
 
   # Decrypt, mount, and take a look around.
   uuid=$(cryptsetup luksUUID "$mountpoint"/disk.img)
-  cryptsetup luksOpen --key-file "$TEST_SCRATCH_DIR"/key "$mountpoint"/disk.img "$uuid"
+  run_with_log cryptsetup luksOpen --key-file "$TEST_SCRATCH_DIR"/key "$mountpoint"/disk.img "$uuid"
   mkdir -p "$TEST_SCRATCH_DIR"/mount
-  mount /dev/mapper/"$uuid" "$TEST_SCRATCH_DIR"/mount
+  run_with_log mount /dev/mapper/"$uuid" "$TEST_SCRATCH_DIR"/mount
   # Should have a not-empty config file with parts of an image's config.
   test -s "$TEST_SCRATCH_DIR"/mount/.krun_config.json
   # Should have a /tmp directory, at least.
@@ -42,9 +42,15 @@ function mkcw_check_image() {
   fi
 
   # Clean up.
-  umount "$TEST_SCRATCH_DIR"/mount
-  cryptsetup luksClose "$uuid"
-  buildah umount "$ctrID"
+  run_with_log umount -f "$TEST_SCRATCH_DIR"/mount
+  # `Retry` if `luksClose` fails with defaults of `run_with_log` because
+  # when unmounting the filesystem mounted on the device /dev/mapper/"$uuid"
+  # without `retry` somehow we end up in a state where mount is still being
+  # used by the kernel because when we do `lsof /dev/mapper/"$uuid"` it
+  # shows nothing but `dmsetup info -c $uuid` shows the device is still
+  # under use. Adding `--retry` in between somehow fixes this.
+  run_with_log --retry cryptsetup luksClose "$uuid"
+  run_buildah umount "$ctrID"
 }
 
 @test "mkcw-convert" {