diff --git a/dracut/29kcrypt/kcrypt-online.service b/dracut/29kcrypt/kcrypt-online.service
new file mode 100644
index 0000000..2bf660e
--- /dev/null
+++ b/dracut/29kcrypt/kcrypt-online.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=kcrypt online mount
+DefaultDependencies=no
+Before=cos-immutable-rootfs.service
+After=network-online.target
+Wants=network-online.target
+ConditionKernelCommandLine=rd.neednet=1
+
+[Service]
+Type=oneshot
+RemainAfterExit=no
+ExecStart=/sbin/kcrypt-mount-local
diff --git a/dracut/29kcrypt/kcrypt.service b/dracut/29kcrypt/kcrypt.service
index c0d4dc9..dee3d2e 100644
--- a/dracut/29kcrypt/kcrypt.service
+++ b/dracut/29kcrypt/kcrypt.service
@@ -2,6 +2,7 @@
 Description=kcrypt mount
 DefaultDependencies=no
 Before=cos-immutable-rootfs.service
+ConditionKernelCommandLine=!rd.neednet=1
 
 [Service]
 Type=oneshot
diff --git a/dracut/29kcrypt/module-setup.sh b/dracut/29kcrypt/module-setup.sh
index aa308fe..b12b7c8 100644
--- a/dracut/29kcrypt/module-setup.sh
+++ b/dracut/29kcrypt/module-setup.sh
@@ -31,8 +31,14 @@ install() {
     #inst_hook pre-trigger 10 "$moddir/mount-local.sh"
     inst_simple "${moddir}/kcrypt.service" \
         "${systemdsystemunitdir}/kcrypt.service"
+
+    inst_simple "${moddir}/kcrypt-online.service" \
+        "${systemdsystemunitdir}/kcrypt-online.service"
+
     mkdir -p "${initdir}/${systemdsystemunitdir}/initrd-fs.target.requires"
     ln_r "../kcrypt.service" \
         "${systemdsystemunitdir}/initrd-fs.target.requires/kcrypt.service"
+    ln_r "../kcrypt-online.service" \
+        "${systemdsystemunitdir}/initrd-fs.target.requires/kcrypt-online.service"
     dracut_need_initqueue
 }
\ No newline at end of file
diff --git a/dracut/29kcrypt/mount-local.sh b/dracut/29kcrypt/mount-local.sh
index 827402d..8a67533 100755
--- a/dracut/29kcrypt/mount-local.sh
+++ b/dracut/29kcrypt/mount-local.sh
@@ -2,6 +2,10 @@
 # -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
 # ex: ts=8 sw=4 sts=4 et filetype=sh
 
+type getarg > /dev/null 2>&1 || . /lib/dracut-lib.sh
+
+PATH=/usr/sbin:/usr/bin:/sbin:/bin
+
 OEM=$(blkid -L COS_OEM)
 if [ "$OEM" != "" ]; then
     mkdir /oem