diff --git a/repos/base-hw/src/core/include/pager.h b/repos/base-hw/src/core/include/pager.h
index 75be29200..9bf06cb02 100644
--- a/repos/base-hw/src/core/include/pager.h
+++ b/repos/base-hw/src/core/include/pager.h
@@ -85,7 +85,6 @@ class Genode::Ipc_pager
 		 */
 		struct Fault_thread_regs
 		{
-			addr_t pd;
 			addr_t ip;
 			addr_t addr;
 			addr_t writes;
@@ -215,14 +214,6 @@ class Genode::Pager_entrypoint : public Object_pool<Pager_object>,
 		 */
 		void dissolve(Pager_object * const obj);
 
-		/**
-		 * Bring current mapping data into effect
-		 *
-		 * \retval  0  succeeded
-		 * \retval -1  failed
-		 */
-		int apply_mapping();
-
 
 		/**********************
 		 ** Thread interface **
diff --git a/repos/base-hw/src/core/include/platform_thread.h b/repos/base-hw/src/core/include/platform_thread.h
index 3e2c0f737..721219e47 100644
--- a/repos/base-hw/src/core/include/platform_thread.h
+++ b/repos/base-hw/src/core/include/platform_thread.h
@@ -176,7 +176,7 @@ namespace Genode {
 			/**
 			 * Return the address space to which the thread is bound
 			 */
-			Weak_ptr<Address_space> address_space();
+			Weak_ptr<Address_space>& address_space();
 
 			/**
 			 * Return execution time consumed by the thread
diff --git a/repos/base-hw/src/core/platform_thread.cc b/repos/base-hw/src/core/platform_thread.cc
index b2696eeab..0e9c84e0d 100644
--- a/repos/base-hw/src/core/platform_thread.cc
+++ b/repos/base-hw/src/core/platform_thread.cc
@@ -30,7 +30,7 @@ using namespace Genode;
 void Platform_thread::_init() { }
 
 
-Weak_ptr<Address_space> Platform_thread::address_space() {
+Weak_ptr<Address_space>& Platform_thread::address_space() {
 	return _address_space; }
 
 
diff --git a/repos/base-hw/src/core/rm_session_support.cc b/repos/base-hw/src/core/rm_session_support.cc
index f5ca7c9fd..45c44a0ed 100644
--- a/repos/base-hw/src/core/rm_session_support.cc
+++ b/repos/base-hw/src/core/rm_session_support.cc
@@ -40,20 +40,6 @@ void Rm_client::unmap(addr_t, addr_t virt_base, size_t size)
  ** Pager_entrypoint **
  **********************/
 
-int Pager_entrypoint::apply_mapping()
-{
-	Page_flags const flags =
-	Page_flags::apply_mapping(_mapping.writable,
-	                          _mapping.cacheable,
-	                          _mapping.io_mem);
-	Platform_pd * const pd = (Platform_pd*)_fault.pd;
-
-	return (pd->insert_translation(_mapping.virt_address,
-	                               _mapping.phys_address,
-	                               1 << _mapping.size_log2, flags)) ? 0 : 1;
-}
-
-
 void Pager_entrypoint::entry()
 {
 	while (1)
@@ -79,7 +65,6 @@ void Pager_entrypoint::entry()
 				return;
 			}
 
-			_fault.pd     = pt->kernel_object()->fault_pd();
 			_fault.ip     = pt->kernel_object()->ip;
 			_fault.addr   = pt->kernel_object()->fault_addr();
 			_fault.writes = pt->kernel_object()->fault_writes();
@@ -89,10 +74,20 @@ void Pager_entrypoint::entry()
 			if (po->pager(*this)) return;
 
 			/* apply mapping that was determined by the local region managers */
-			if (apply_mapping()) {
-				PWRN("failed to apply mapping");
-				return;
+			{
+				Locked_ptr<Address_space> locked_ptr(pt->address_space());
+				if (!locked_ptr.is_valid()) return;
+
+				Hw::Address_space * as = static_cast<Hw::Address_space*>(&*locked_ptr);
+				Page_flags const flags =
+					Page_flags::apply_mapping(_mapping.writable,
+											  _mapping.cacheable,
+											  _mapping.io_mem);
+				as->insert_translation(_mapping.virt_address,
+									   _mapping.phys_address,
+									   1 << _mapping.size_log2, flags);
 			}
+
 			/* let pager object go back to no-fault state */
 			po->wake_up();
 		};