diff --git a/borg/archiver.py b/borg/archiver.py
index 667a8e90b..c2626beba 100644
--- a/borg/archiver.py
+++ b/borg/archiver.py
@@ -1546,6 +1546,13 @@ class Archiver:
         - allow_damaged_files: by default damaged files (where missing chunks were
           replaced with runs of zeros by borg check --repair) are not readable and
           return EIO (I/O error). Set this option to read such files.
+
+        When the daemonized process receives a signal or crashes, it does not unmount.
+        Unmounting in these cases could cause an active rsync or similar process
+        to unintentionally delete data.
+
+        When running in the foreground ^C/SIGINT unmounts cleanly, but other
+        signals or crashes do not.
         """)
         subparser = subparsers.add_parser('mount', parents=[common_parser],
                                           description=self.do_mount.__doc__,
diff --git a/borg/fuse.py b/borg/fuse.py
index f92f76900..710611004 100644
--- a/borg/fuse.py
+++ b/borg/fuse.py
@@ -6,6 +6,7 @@ import os
 import stat
 import tempfile
 import time
+from signal import SIGINT
 from distutils.version import LooseVersion
 
 import msgpack
@@ -98,7 +99,8 @@ class FuseOperations(llfuse.Operations):
         umount = False
         try:
             signal = fuse_main()
-            umount = (signal is None)  # no crash and no signal -> umount request
+            # no crash and no signal (or it's ^C and we're in the foreground) -> umount request
+            umount = (signal is None or (signal == SIGINT and foreground))
         finally:
             llfuse.close(umount)