diff --git a/.changelog/15626.txt b/.changelog/15626.txt
new file mode 100644
index 000000000..2eecd7f91
--- /dev/null
+++ b/.changelog/15626.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+fix: Add the missing option propagation_mode for volume_mount
+```
diff --git a/client/allocrunner/taskrunner/volume_hook.go b/client/allocrunner/taskrunner/volume_hook.go
index 7aeab512d..54819e3ea 100644
--- a/client/allocrunner/taskrunner/volume_hook.go
+++ b/client/allocrunner/taskrunner/volume_hook.go
@@ -88,9 +88,10 @@ func (h *volumeHook) hostVolumeMountConfigurations(taskMounts []*structs.VolumeM
 		}
 
 		mcfg := &drivers.MountConfig{
-			HostPath: hostVolume.Path,
-			TaskPath: m.Destination,
-			Readonly: hostVolume.ReadOnly || req.ReadOnly || m.ReadOnly,
+			HostPath:        hostVolume.Path,
+			TaskPath:        m.Destination,
+			Readonly:        hostVolume.ReadOnly || req.ReadOnly || m.ReadOnly,
+			PropagationMode: m.PropagationMode,
 		}
 		mounts = append(mounts, mcfg)
 	}
@@ -180,9 +181,10 @@ func (h *volumeHook) prepareCSIVolumes(req *interfaces.TaskPrestartRequest, volu
 
 		for _, m := range mountsForAlias {
 			mcfg := &drivers.MountConfig{
-				HostPath: csiMountPoint.Source,
-				TaskPath: m.Destination,
-				Readonly: request.ReadOnly || m.ReadOnly,
+				HostPath:        csiMountPoint.Source,
+				TaskPath:        m.Destination,
+				Readonly:        request.ReadOnly || m.ReadOnly,
+				PropagationMode: m.PropagationMode,
 			}
 			mounts = append(mounts, mcfg)
 		}
diff --git a/website/content/docs/job-specification/volume_mount.mdx b/website/content/docs/job-specification/volume_mount.mdx
index 97e424f8e..078a33bac 100644
--- a/website/content/docs/job-specification/volume_mount.mdx
+++ b/website/content/docs/job-specification/volume_mount.mdx
@@ -26,6 +26,7 @@ job "docs" {
       volume_mount {
         volume      = "certs"
         destination = "/etc/ssl/certs"
+        propagation_mode = "private"
       }
     }
   }