diff --git a/src/analyze/analyze-security.c b/src/analyze/analyze-security.c
index c0481c72ec..3289ae8f47 100644
--- a/src/analyze/analyze-security.c
+++ b/src/analyze/analyze-security.c
@@ -626,7 +626,7 @@ static int assess_system_call_filter(
         uint64_t b;
         int r;
 
-        r = DLOPEN_LIBSECCOMP(LOG_DEBUG, recommended);
+        r = dlopen_libseccomp(LOG_DEBUG);
         if (r < 0) {
                 *ret_badness = UINT64_MAX;
                 *ret_description = NULL;
@@ -2604,7 +2604,7 @@ static int get_security_info(Unit *u, ExecContext *c, CGroupContext *g, RuntimeS
                 info->_umask = c->umask;
 
 #if HAVE_SECCOMP
-                if (DLOPEN_LIBSECCOMP(LOG_DEBUG, recommended) >= 0) {
+                if (dlopen_libseccomp(LOG_DEBUG) >= 0) {
                         SET_FOREACH(key, c->syscall_archs) {
                                 const char *name;
 
diff --git a/src/analyze/analyze.c b/src/analyze/analyze.c
index df41db77ad..fbdbc83fe7 100644
--- a/src/analyze/analyze.c
+++ b/src/analyze/analyze.c
@@ -697,6 +697,7 @@ static int run(int argc, char *argv[]) {
         LIBELF_NOTE(suggested);
         LIBMOUNT_NOTE(recommended);
         LIBPCRE2_NOTE(suggested);
+        LIBSECCOMP_NOTE(recommended);
         LIBSELINUX_NOTE(recommended);
         TPM2_NOTE(suggested);
 
diff --git a/src/bootctl/bootctl-install.c b/src/bootctl/bootctl-install.c
index d75b4f67bb..1610d11e92 100644
--- a/src/bootctl/bootctl-install.c
+++ b/src/bootctl/bootctl-install.c
@@ -1085,7 +1085,7 @@ static int install_secure_boot_auto_enroll(InstallContext *c) {
         if (!c->secure_boot_certificate || !c->secure_boot_private_key)
                 return 0;
 
-        r = DLOPEN_LIBCRYPTO(LOG_DEBUG, recommended);
+        r = dlopen_libcrypto(LOG_DEBUG);
         if (r < 0)
                 return r;
 
diff --git a/src/bootctl/bootctl.c b/src/bootctl/bootctl.c
index 238102095e..7956b01ffc 100644
--- a/src/bootctl/bootctl.c
+++ b/src/bootctl/bootctl.c
@@ -860,6 +860,7 @@ static int run(int argc, char *argv[]) {
         int r;
 
         LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(recommended);
         LIBCRYPTSETUP_NOTE(suggested);
         LIBMOUNT_NOTE(recommended);
         LIBTSS2_ESYS_NOTE(suggested);
diff --git a/src/core/bpf-bind-iface.c b/src/core/bpf-bind-iface.c
index 4b492f77ba..1ba643a116 100644
--- a/src/core/bpf-bind-iface.c
+++ b/src/core/bpf-bind-iface.c
@@ -31,7 +31,7 @@ int bpf_bind_network_interface_supported(void) {
         if (supported >= 0)
                 return supported;
 
-        if (DLOPEN_BPF(LOG_WARNING, recommended) < 0)
+        if (dlopen_bpf(LOG_WARNING) < 0)
                 return (supported = false);
 
         obj = bind_iface_bpf__open();
diff --git a/src/core/bpf-restrict-fs.c b/src/core/bpf-restrict-fs.c
index 33dba6d8da..a0bd4823b0 100644
--- a/src/core/bpf-restrict-fs.c
+++ b/src/core/bpf-restrict-fs.c
@@ -78,7 +78,7 @@ bool bpf_restrict_fs_supported(bool initialize) {
         if (!initialize)
                 return false;
 
-        if (DLOPEN_BPF(LOG_WARNING, recommended) < 0)
+        if (dlopen_bpf(LOG_WARNING) < 0)
                 return (supported = false);
 
         r = lsm_supported("bpf");
diff --git a/src/core/bpf-restrict-fsaccess.c b/src/core/bpf-restrict-fsaccess.c
index 18d291795e..e2d5cbf955 100644
--- a/src/core/bpf-restrict-fsaccess.c
+++ b/src/core/bpf-restrict-fsaccess.c
@@ -171,7 +171,7 @@ bool bpf_restrict_fsaccess_supported(void) {
 
         if (supported >= 0)
                 return supported;
-        if (DLOPEN_BPF(LOG_WARNING, recommended) < 0)
+        if (dlopen_bpf(LOG_WARNING) < 0)
                 return (supported = false);
 
         r = lsm_supported("bpf");
@@ -340,7 +340,7 @@ static int restrict_fsaccess_validate_deserialized_fds(Manager *m) {
 
         assert(m);
 
-        r = DLOPEN_BPF(LOG_WARNING, recommended);
+        r = dlopen_bpf(LOG_WARNING);
         if (r < 0)
                 return log_error_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
                                        "bpf-restrict-fsaccess: Failed to load libbpf for FD validation, aborting.");
diff --git a/src/core/bpf-restrict-ifaces.c b/src/core/bpf-restrict-ifaces.c
index e6b3292380..e30d15cd25 100644
--- a/src/core/bpf-restrict-ifaces.c
+++ b/src/core/bpf-restrict-ifaces.c
@@ -86,7 +86,7 @@ int bpf_restrict_ifaces_supported(void) {
         if (supported >= 0)
                 return supported;
 
-        if (DLOPEN_BPF(LOG_WARNING, recommended) < 0)
+        if (dlopen_bpf(LOG_WARNING) < 0)
                 return (supported = false);
 
         r = prepare_restrict_ifaces_bpf(NULL, true, NULL, &obj);
diff --git a/src/core/bpf-socket-bind.c b/src/core/bpf-socket-bind.c
index 47f0d209f7..b4bf37b41e 100644
--- a/src/core/bpf-socket-bind.c
+++ b/src/core/bpf-socket-bind.c
@@ -125,7 +125,7 @@ int bpf_socket_bind_supported(void) {
         _cleanup_(socket_bind_bpf_freep) struct socket_bind_bpf *obj = NULL;
         int r;
 
-        if (DLOPEN_BPF(LOG_WARNING, recommended) < 0)
+        if (dlopen_bpf(LOG_WARNING) < 0)
                 return false;
 
         r = prepare_socket_bind_bpf(/* unit= */ NULL, /* allow_rules= */ NULL, /* deny_rules= */ NULL, &obj);
diff --git a/src/core/exec-invoke.c b/src/core/exec-invoke.c
index bdd98e4a71..ae3001418a 100644
--- a/src/core/exec-invoke.c
+++ b/src/core/exec-invoke.c
@@ -1311,7 +1311,7 @@ static int setup_pam(
          * parent process will exec() the actual daemon. We do things this way to ensure that the main PID of
          * the daemon is the one we initially fork()ed. */
 
-        r = DLOPEN_LIBPAM(LOG_ERR, recommended);
+        r = dlopen_libpam(LOG_ERR);
         if (r < 0)
                 return r;
 
@@ -1578,7 +1578,7 @@ static bool seccomp_allows_drop_privileges(const ExecContext *c) {
         assert(c);
 
         /* No libseccomp, all is fine */
-        if (DLOPEN_LIBSECCOMP(LOG_DEBUG, recommended) < 0)
+        if (dlopen_libseccomp(LOG_DEBUG) < 0)
                 return true;
 
         /* No syscall filter, we are allowed to drop privileges */
@@ -1888,7 +1888,7 @@ static int apply_restrict_filesystems(const ExecContext *c, const ExecParameters
         }
 
         /* We are in a new binary, so dl-open again */
-        r = DLOPEN_BPF(LOG_DEBUG, recommended);
+        r = dlopen_bpf(LOG_DEBUG);
         if (r < 0)
                 return r;
 
@@ -6006,12 +6006,12 @@ int exec_invoke(
         }
 
         /* Load a bunch of libraries we'll possibly need later, before we turn off dlopen() */
-        (void) DLOPEN_BPF(LOG_DEBUG, recommended);
-        (void) DLOPEN_CRYPTSETUP(LOG_DEBUG, recommended);
-        (void) DLOPEN_LIBMOUNT(LOG_DEBUG, recommended);
-        (void) DLOPEN_LIBSECCOMP(LOG_DEBUG, recommended);
+        (void) dlopen_bpf(LOG_DEBUG);
+        (void) dlopen_cryptsetup(LOG_DEBUG);
+        (void) dlopen_libmount(LOG_DEBUG);
+        (void) dlopen_libseccomp(LOG_DEBUG);
         /* Needed for userspace verity verification fallback */
-        (void) DLOPEN_LIBCRYPTO(LOG_DEBUG, recommended);
+        (void) dlopen_libcrypto(LOG_DEBUG);
 
         /* Let's now disable further dlopen()ing of libraries, since we are about to do namespace
          * shenanigans, and do not want to mix resources from host and namespace */
diff --git a/src/core/execute.c b/src/core/execute.c
index 8eb505d4fb..fd32d38ad1 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -1575,7 +1575,7 @@ void exec_context_dump(const ExecContext *c, FILE* f, const char *prefix) {
                         fputc('~', f);
 
 #if HAVE_SECCOMP
-                if (DLOPEN_LIBSECCOMP(LOG_DEBUG, recommended) >= 0) {
+                if (dlopen_libseccomp(LOG_DEBUG) >= 0) {
                         void *id, *val;
                         bool first = true;
                         HASHMAP_FOREACH_KEY(val, id, c->syscall_filter) {
@@ -1996,7 +1996,7 @@ char** exec_context_get_syscall_filter(const ExecContext *c) {
         assert(c);
 
 #if HAVE_SECCOMP
-        if (DLOPEN_LIBSECCOMP(LOG_DEBUG, recommended) < 0)
+        if (dlopen_libseccomp(LOG_DEBUG) < 0)
                 return strv_new(NULL);
 
         void *id, *val;
@@ -2065,7 +2065,7 @@ char** exec_context_get_syscall_log(const ExecContext *c) {
         assert(c);
 
 #if HAVE_SECCOMP
-        if (DLOPEN_LIBSECCOMP(LOG_DEBUG, recommended) < 0)
+        if (dlopen_libseccomp(LOG_DEBUG) < 0)
                 return strv_new(NULL);
 
         void *id, *val;
diff --git a/src/core/executor.c b/src/core/executor.c
index d0cd16aa9a..0c104e5c31 100644
--- a/src/core/executor.c
+++ b/src/core/executor.c
@@ -236,6 +236,12 @@ int run_executor(int argc, char *argv[]) {
         LIBACL_NOTE(recommended);
         LIBAPPARMOR_NOTE(recommended);
         LIBBLKID_NOTE(recommended);
+        LIBBPF_NOTE(recommended);
+        LIBCRYPTO_NOTE(recommended);
+        LIBCRYPTSETUP_NOTE(recommended);
+        LIBMOUNT_NOTE(recommended);
+        LIBPAM_NOTE(recommended);
+        LIBSECCOMP_NOTE(recommended);
         LIBSELINUX_NOTE(recommended);
         TPM2_NOTE(suggested);
 
diff --git a/src/core/main.c b/src/core/main.c
index c952472e73..84f3b029e1 100644
--- a/src/core/main.c
+++ b/src/core/main.c
@@ -3823,7 +3823,7 @@ static int run_systemd(int argc, char *argv[]) {
         }
 
         /* Building without libmount is allowed, but if it is compiled in, then we must be able to load it */
-        r = DLOPEN_LIBMOUNT(LOG_DEBUG, required);
+        r = dlopen_libmount(LOG_DEBUG);
         if (r < 0 && !ERRNO_IS_NEG_NOT_SUPPORTED(r)) {
                 error_message = "Failed to load libmount.so";
                 goto finish;
@@ -4035,8 +4035,10 @@ int main(int argc, char *argv[]) {
         LIBCRYPTO_NOTE(suggested);
         LIBCRYPTSETUP_NOTE(recommended);
         LIBKMOD_NOTE(recommended);
+        LIBMOUNT_NOTE(required);
         LIBPCRE2_NOTE(suggested);
         LIBSECCOMP_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
         TPM2_NOTE(suggested);
 
 #if SYSTEMD_MULTICALL_BINARY
diff --git a/src/core/mount.c b/src/core/mount.c
index 45a84e6350..c05df5d10c 100644
--- a/src/core/mount.c
+++ b/src/core/mount.c
@@ -2407,7 +2407,7 @@ static int mount_test_startable(Unit *u) {
 }
 
 static bool mount_supported(void) {
-        return DLOPEN_LIBMOUNT(LOG_DEBUG, recommended) >= 0;
+        return dlopen_libmount(LOG_DEBUG) >= 0;
 }
 
 static int mount_subsystem_ratelimited(Manager *m) {
diff --git a/src/core/namespace.c b/src/core/namespace.c
index ff9a975b08..c60f2e99c0 100644
--- a/src/core/namespace.c
+++ b/src/core/namespace.c
@@ -3986,7 +3986,7 @@ int refresh_extensions_in_namespace(
         if (r > 0)
                 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Target namespace is not separate, cannot reload extensions");
 
-        (void) DLOPEN_CRYPTSETUP(LOG_DEBUG, recommended);
+        (void) dlopen_cryptsetup(LOG_DEBUG);
 
         extension_dir = path_join(p->private_namespace_dir, "unit-extensions");
         if (!extension_dir)
diff --git a/src/core/selinux-setup.c b/src/core/selinux-setup.c
index fa65567ab0..d06c9f0293 100644
--- a/src/core/selinux-setup.c
+++ b/src/core/selinux-setup.c
@@ -17,7 +17,7 @@ int mac_selinux_setup(bool *loaded_policy) {
 
         assert(loaded_policy);
 
-        r = DLOPEN_LIBSELINUX(LOG_DEBUG, recommended);
+        r = dlopen_libselinux(LOG_DEBUG);
         if (r < 0)
                 return 0;
 
diff --git a/src/creds/creds.c b/src/creds/creds.c
index 765185dbe7..48432f8669 100644
--- a/src/creds/creds.c
+++ b/src/creds/creds.c
@@ -189,7 +189,7 @@ static int is_tmpfs_with_noswap(dev_t devno) {
         _cleanup_(mnt_free_tablep) struct libmnt_table *table = NULL;
         int r;
 
-        r = DLOPEN_LIBMOUNT(LOG_DEBUG, recommended);
+        r = dlopen_libmount(LOG_DEBUG);
         if (r < 0)
                 return r;
 
@@ -1473,6 +1473,7 @@ static int run(int argc, char *argv[]) {
         int r;
 
         LIBCRYPTO_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
         TPM2_NOTE(suggested);
 
         log_setup();
diff --git a/src/cryptenroll/cryptenroll-varlink.c b/src/cryptenroll/cryptenroll-varlink.c
index 83d448dc65..d268eb9956 100644
--- a/src/cryptenroll/cryptenroll-varlink.c
+++ b/src/cryptenroll/cryptenroll-varlink.c
@@ -344,7 +344,7 @@ static int vl_method_enroll(
         if (FLAGS_SET(flags, SD_VARLINK_METHOD_MORE))
                 c.link = sd_varlink_ref(link);
 
-        r = DLOPEN_CRYPTSETUP(LOG_DEBUG, required);
+        r = dlopen_cryptsetup(LOG_DEBUG);
         if (r < 0)
                 return r;
 
@@ -421,7 +421,7 @@ static int vl_method_list_slots(
         if (strdup_to(&c.node, node) < 0)
                 return -ENOMEM;
 
-        r = DLOPEN_CRYPTSETUP(LOG_DEBUG, required);
+        r = dlopen_cryptsetup(LOG_DEBUG);
         if (r < 0)
                 return r;
 
diff --git a/src/cryptenroll/cryptenroll.c b/src/cryptenroll/cryptenroll.c
index f295585ff9..32d79077c3 100644
--- a/src/cryptenroll/cryptenroll.c
+++ b/src/cryptenroll/cryptenroll.c
@@ -1257,6 +1257,7 @@ static int run(int argc, char *argv[]) {
         int slot, r;
 
         LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(required);
         LIBFIDO2_NOTE(suggested);
         LIBP11KIT_NOTE(suggested);
         LIBQRENCODE_NOTE(suggested);
@@ -1282,7 +1283,7 @@ static int run(int argc, char *argv[]) {
         if (r <= 0)
                 return r;
 
-        r = DLOPEN_CRYPTSETUP(LOG_ERR, required);
+        r = dlopen_cryptsetup(LOG_ERR);
         if (r < 0)
                 return r;
 
diff --git a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-fido2.c b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-fido2.c
index 93be8dcb3c..d920fdb243 100644
--- a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-fido2.c
+++ b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-fido2.c
@@ -19,6 +19,7 @@
 
 /* for libcryptsetup debug purpose */
 _public_ const char* cryptsetup_token_version(void) {
+        LIBCRYPTSETUP_NOTE(required);
         LIBFIDO2_NOTE(suggested);
 
         return TOKEN_VERSION_MAJOR "." TOKEN_VERSION_MINOR " systemd-v" PROJECT_VERSION_FULL " (" GIT_VERSION ")";
@@ -40,7 +41,7 @@ _public_ int cryptsetup_token_open_pin(
         assert(pin || pin_size == 0);
         assert(token >= 0);
 
-        r = DLOPEN_CRYPTSETUP(LOG_DEBUG, required);
+        r = dlopen_cryptsetup(LOG_DEBUG);
         if (r < 0)
                 return r;
 
@@ -105,7 +106,7 @@ _public_ void cryptsetup_token_dump(
 
         assert(json);
 
-        if (DLOPEN_CRYPTSETUP(LOG_DEBUG, required) < 0)
+        if (dlopen_cryptsetup(LOG_DEBUG) < 0)
                 return;
 
         r = parse_luks2_fido2_data(cd, json, &rp_id, &salt, &salt_size, &cid, &cid_size, &required);
@@ -172,7 +173,7 @@ _public_ int cryptsetup_token_validate(
 
         assert(json);
 
-        r = DLOPEN_CRYPTSETUP(LOG_DEBUG, required);
+        r = dlopen_cryptsetup(LOG_DEBUG);
         if (r < 0)
                 return r;
 
diff --git a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-pkcs11.c b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-pkcs11.c
index 3c55866fb2..8cc5995a8b 100644
--- a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-pkcs11.c
+++ b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-pkcs11.c
@@ -20,6 +20,7 @@
 /* for libcryptsetup debug purpose */
 _public_ const char* cryptsetup_token_version(void) {
         LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(required);
         LIBP11KIT_NOTE(suggested);
 
         return TOKEN_VERSION_MAJOR "." TOKEN_VERSION_MINOR " systemd-v" PROJECT_VERSION_FULL " (" GIT_VERSION ")";
@@ -40,7 +41,7 @@ _public_ int cryptsetup_token_open_pin(
         assert(pin || pin_size == 0);
         assert(token >= 0);
 
-        r = DLOPEN_CRYPTSETUP(LOG_DEBUG, required);
+        r = dlopen_cryptsetup(LOG_DEBUG);
         if (r < 0)
                 return r;
 
@@ -98,7 +99,7 @@ _public_ void cryptsetup_token_dump(
         _cleanup_free_ void *pkcs11_key = NULL;
         Pkcs11RsaPadding rsa_padding = PKCS11_RSA_PADDING_PKCS1V15;
 
-        if (DLOPEN_CRYPTSETUP(LOG_DEBUG, required) < 0)
+        if (dlopen_cryptsetup(LOG_DEBUG) < 0)
                 return;
 
         r = parse_luks2_pkcs11_data(cd, json, &pkcs11_uri, &pkcs11_key, &pkcs11_key_size, &rsa_padding);
@@ -128,7 +129,7 @@ _public_ int cryptsetup_token_validate(
         sd_json_variant *w;
         _cleanup_(sd_json_variant_unrefp) sd_json_variant *v = NULL;
 
-        r = DLOPEN_CRYPTSETUP(LOG_DEBUG, required);
+        r = dlopen_cryptsetup(LOG_DEBUG);
         if (r < 0)
                 return r;
 
diff --git a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-tpm2.c b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-tpm2.c
index 126982b6b2..6da2c22a45 100644
--- a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-tpm2.c
+++ b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-tpm2.c
@@ -21,6 +21,7 @@
 /* for libcryptsetup debug purpose */
 _public_ const char* cryptsetup_token_version(void) {
         LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(required);
         TPM2_NOTE(suggested);
 
         return TOKEN_VERSION_MAJOR "." TOKEN_VERSION_MINOR " systemd-v" PROJECT_VERSION_FULL " (" GIT_VERSION ")";
@@ -73,7 +74,7 @@ _public_ int cryptsetup_token_open_pin(
         assert(ret_password);
         assert(ret_password_len);
 
-        r = DLOPEN_CRYPTSETUP(LOG_DEBUG, required);
+        r = dlopen_cryptsetup(LOG_DEBUG);
         if (r < 0)
                 return r;
 
@@ -217,7 +218,7 @@ _public_ void cryptsetup_token_dump(
 
         assert(json);
 
-        if (DLOPEN_CRYPTSETUP(LOG_DEBUG, required) < 0)
+        if (dlopen_cryptsetup(LOG_DEBUG) < 0)
                 return;
 
         r = sd_json_parse(json, SD_JSON_PARSE_MUST_BE_OBJECT, &v, /* reterr_line= */ NULL, /* reterr_column= */ NULL);
@@ -313,7 +314,7 @@ _public_ int cryptsetup_token_validate(
 
         assert(json);
 
-        r = DLOPEN_CRYPTSETUP(LOG_DEBUG, required);
+        r = dlopen_cryptsetup(LOG_DEBUG);
         if (r < 0)
                 return r;
 
diff --git a/src/cryptsetup/cryptsetup.c b/src/cryptsetup/cryptsetup.c
index bce07454a9..794983dcb6 100644
--- a/src/cryptsetup/cryptsetup.c
+++ b/src/cryptsetup/cryptsetup.c
@@ -539,7 +539,7 @@ static int parse_one_option(const char *option) {
 #if HAVE_OPENSSL
                 _cleanup_strv_free_ char **l = NULL;
 
-                r = DLOPEN_LIBCRYPTO(LOG_ERR, recommended);
+                r = dlopen_libcrypto(LOG_ERR);
                 if (r < 0)
                         return r;
 
@@ -2885,6 +2885,8 @@ static int run(int argc, char *argv[]) {
         int r;
 
         LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(recommended);
+        LIBCRYPTSETUP_NOTE(required);
         LIBFIDO2_NOTE(suggested);
         LIBMOUNT_NOTE(recommended);
         LIBP11KIT_NOTE(suggested);
@@ -2899,7 +2901,7 @@ static int run(int argc, char *argv[]) {
         if (r <= 0)
                 return r;
 
-        r = DLOPEN_CRYPTSETUP(LOG_ERR, required);
+        r = dlopen_cryptsetup(LOG_ERR);
         if (r < 0)
                 return r;
 
diff --git a/src/dissect/dissect.c b/src/dissect/dissect.c
index 602306d9b9..16a5d46629 100644
--- a/src/dissect/dissect.c
+++ b/src/dissect/dissect.c
@@ -494,7 +494,7 @@ static int parse_argv(int argc, char *argv[]) {
                         break;
 
                 OPTION_LONG("make-archive", NULL, "Convert the DDI to an archive file"):
-                        r = DLOPEN_LIBARCHIVE(LOG_ERR, recommended);
+                        r = dlopen_libarchive(LOG_ERR);
                         if (r < 0)
                                 return r;
 
@@ -1970,6 +1970,7 @@ static int run(int argc, char *argv[]) {
         int r;
 
         LIBACL_NOTE(recommended);
+        LIBARCHIVE_NOTE(recommended);
         LIBBLKID_NOTE(recommended);
         LIBCRYPTO_NOTE(suggested);
         LIBCRYPTSETUP_NOTE(suggested);
diff --git a/src/growfs/growfs.c b/src/growfs/growfs.c
index e9b34529b5..8b1bb9b759 100644
--- a/src/growfs/growfs.c
+++ b/src/growfs/growfs.c
@@ -34,7 +34,7 @@ static int resize_crypt_luks_device(dev_t devno, const char *fstype, dev_t main_
         uint64_t size;
         int r;
 
-        r = DLOPEN_CRYPTSETUP(LOG_WARNING, recommended);
+        r = dlopen_cryptsetup(LOG_WARNING);
         if (r < 0)
                 return r;
 
@@ -194,6 +194,7 @@ static int run(int argc, char *argv[]) {
         int r;
 
         LIBBLKID_NOTE(recommended);
+        LIBCRYPTSETUP_NOTE(recommended);
 
         log_setup();
 
diff --git a/src/home/homectl.c b/src/home/homectl.c
index f4be3c0e70..98c24bafe1 100644
--- a/src/home/homectl.c
+++ b/src/home/homectl.c
@@ -2502,7 +2502,7 @@ static int verb_list_signing_keys(int argc, char *argv[], uintptr_t _data, void
                         /* Let's decode the PEM key to DER (so that we lose prefix/suffix), then truncate it
                          * for display reasons. */
 
-                        r = DLOPEN_LIBCRYPTO(LOG_DEBUG, recommended);
+                        r = dlopen_libcrypto(LOG_DEBUG);
                         if (r < 0)
                                 return r;
 
@@ -5185,6 +5185,7 @@ static int run(int argc, char *argv[]) {
         int r;
 
         LIBCRYPT_NOTE(recommended);
+        LIBCRYPTO_NOTE(recommended);
         LIBFIDO2_NOTE(suggested);
         LIBP11KIT_NOTE(suggested);
         LIBQRENCODE_NOTE(suggested);
diff --git a/src/home/homed-manager.c b/src/home/homed-manager.c
index a19dc3f6c8..d6ed1673b2 100644
--- a/src/home/homed-manager.c
+++ b/src/home/homed-manager.c
@@ -1545,7 +1545,7 @@ int manager_startup(Manager *m) {
 
         assert(m);
 
-        r = DLOPEN_LIBCRYPTO(LOG_ERR, required);
+        r = dlopen_libcrypto(LOG_ERR);
         if (r < 0)
                 return r;
 
diff --git a/src/home/homed.c b/src/home/homed.c
index fc573c5f78..f36e61d04e 100644
--- a/src/home/homed.c
+++ b/src/home/homed.c
@@ -20,6 +20,7 @@ static int run(int argc, char *argv[]) {
         int r;
 
         LIBCRYPT_NOTE(recommended);
+        LIBCRYPTO_NOTE(required);
         PASSWORD_NOTE(suggested);
 
         log_setup();
diff --git a/src/home/homework-fscrypt.c b/src/home/homework-fscrypt.c
index 6c9692ff82..432f5d8678 100644
--- a/src/home/homework-fscrypt.c
+++ b/src/home/homework-fscrypt.c
@@ -232,7 +232,7 @@ static int fscrypt_slot_try_v1(
         assert(encrypted_size > 0);
         assert(match_key_descriptor);
 
-        r = DLOPEN_LIBCRYPTO(LOG_ERR, recommended);
+        r = dlopen_libcrypto(LOG_ERR);
         if (r < 0)
                 return r;
 
@@ -331,7 +331,7 @@ static int fscrypt_slot_try_v2(
         assert(iovec_is_set(tag));
         assert(match_key_descriptor);
 
-        r = DLOPEN_LIBCRYPTO(LOG_ERR, recommended);
+        r = dlopen_libcrypto(LOG_ERR);
         if (r < 0)
                 return r;
 
@@ -700,7 +700,7 @@ static int fscrypt_slot_set(
         size_t encrypted_size;
         ssize_t ss;
 
-        r = DLOPEN_LIBCRYPTO(LOG_ERR, recommended);
+        r = dlopen_libcrypto(LOG_ERR);
         if (r < 0)
                 return r;
 
@@ -813,7 +813,7 @@ int home_create_fscrypt(
         assert(setup);
         assert(ret_home);
 
-        r = DLOPEN_LIBCRYPTO(LOG_ERR, recommended);
+        r = dlopen_libcrypto(LOG_ERR);
         if (r < 0)
                 return r;
 
diff --git a/src/home/homework-luks.c b/src/home/homework-luks.c
index b18805fa3e..c346ae7fea 100644
--- a/src/home/homework-luks.c
+++ b/src/home/homework-luks.c
@@ -146,7 +146,7 @@ static int probe_file_system_by_fd(
         assert(ret_fstype);
         assert(ret_uuid);
 
-        r = DLOPEN_LIBBLKID(LOG_DEBUG, recommended);
+        r = dlopen_libblkid(LOG_DEBUG);
         if (r < 0)
                 return r;
 
@@ -529,7 +529,7 @@ static int acquire_open_luks_device(
         assert(setup);
         assert(!setup->crypt_device);
 
-        r = DLOPEN_CRYPTSETUP(LOG_DEBUG, recommended);
+        r = dlopen_cryptsetup(LOG_DEBUG);
         if (r < 0)
                 return r;
 
@@ -684,7 +684,7 @@ static int luks_validate(
         assert(ret_size);
         assert(sector_size > 0);
 
-        r = DLOPEN_LIBBLKID(LOG_DEBUG, recommended);
+        r = dlopen_libblkid(LOG_DEBUG);
         if (r < 0)
                 return r;
 
@@ -805,7 +805,7 @@ static int crypt_device_to_evp_cipher(struct crypt_device *cd, const EVP_CIPHER
         assert(cd);
         assert(ret);
 
-        r = DLOPEN_LIBCRYPTO(LOG_ERR, recommended);
+        r = dlopen_libcrypto(LOG_ERR);
         if (r < 0)
                 return r;
 
@@ -1293,7 +1293,7 @@ int home_setup_luks(
         assert(setup);
         assert(user_record_storage(h) == USER_LUKS);
 
-        r = DLOPEN_CRYPTSETUP(LOG_DEBUG, recommended);
+        r = dlopen_cryptsetup(LOG_DEBUG);
         if (r < 0)
                 return r;
 
@@ -1594,7 +1594,7 @@ int home_activate_luks(
         assert(setup);
         assert(ret_home);
 
-        r = DLOPEN_CRYPTSETUP(LOG_DEBUG, recommended);
+        r = dlopen_cryptsetup(LOG_DEBUG);
         if (r < 0)
                 return r;
 
@@ -2211,11 +2211,11 @@ int home_create_luks(
         assert(setup->image_fd < 0);
         assert(ret_home);
 
-        r = DLOPEN_FDISK(LOG_DEBUG, recommended);
+        r = dlopen_fdisk(LOG_DEBUG);
         if (r < 0)
                 return r;
 
-        r = DLOPEN_CRYPTSETUP(LOG_DEBUG, recommended);
+        r = dlopen_cryptsetup(LOG_DEBUG);
         if (r < 0)
                 return r;
 
@@ -3250,11 +3250,11 @@ int home_resize_luks(
         assert(user_record_storage(h) == USER_LUKS);
         assert(setup);
 
-        r = DLOPEN_FDISK(LOG_DEBUG, recommended);
+        r = dlopen_fdisk(LOG_DEBUG);
         if (r < 0)
                 return r;
 
-        r = DLOPEN_CRYPTSETUP(LOG_DEBUG, recommended);
+        r = dlopen_cryptsetup(LOG_DEBUG);
         if (r < 0)
                 return r;
 
@@ -3712,7 +3712,7 @@ int home_passwd_luks(
         assert(user_record_storage(h) == USER_LUKS);
         assert(setup);
 
-        r = DLOPEN_CRYPTSETUP(LOG_DEBUG, recommended);
+        r = dlopen_cryptsetup(LOG_DEBUG);
         if (r < 0)
                 return r;
 
diff --git a/src/home/homework.c b/src/home/homework.c
index 7e48f01206..e8747b73ce 100644
--- a/src/home/homework.c
+++ b/src/home/homework.c
@@ -1329,7 +1329,7 @@ static int determine_default_storage(UserStorage *ret) {
                         if (r < 0)
                                 log_warning_errno(r, "Failed to determine if %s is encrypted, ignoring: %m", get_home_root());
 
-                        r = DLOPEN_CRYPTSETUP(LOG_DEBUG, recommended);
+                        r = dlopen_cryptsetup(LOG_DEBUG);
                         if (r < 0)
                                 log_info("Not using '%s' storage, since libcryptsetup could not be loaded.", user_storage_to_string(USER_LUKS));
                         else {
@@ -1999,7 +1999,11 @@ static int run(int argc, char *argv[]) {
         sd_json_variant *fdmap, *blob_fd_variant;
         int r;
 
+        LIBBLKID_NOTE(recommended);
         LIBCRYPT_NOTE(recommended);
+        LIBCRYPTO_NOTE(recommended);
+        LIBCRYPTSETUP_NOTE(recommended);
+        LIBFDISK_NOTE(recommended);
         LIBFIDO2_NOTE(suggested);
         LIBMOUNT_NOTE(recommended);
         LIBP11KIT_NOTE(suggested);
diff --git a/src/home/pam_systemd_home.c b/src/home/pam_systemd_home.c
index c9a6a6ab28..e417709267 100644
--- a/src/home/pam_systemd_home.c
+++ b/src/home/pam_systemd_home.c
@@ -6,6 +6,7 @@
 #include "bus-common-errors.h"
 #include "bus-locator.h"
 #include "bus-util.h"
+#include "dlopen-note.h"
 #include "fd-util.h"
 #include "home-util.h"
 #include "locale-util.h"
@@ -786,7 +787,8 @@ _public_ PAM_EXTERN int pam_sm_authenticate(
         bool debug = false;
         int r;
 
-        r = DLOPEN_LIBPAM(LOG_DEBUG, required);
+        LIBPAM_NOTE(required);
+        r = dlopen_libpam(LOG_DEBUG);
         if (r < 0)
                 return PAM_SERVICE_ERR;
 
@@ -851,7 +853,7 @@ _public_ PAM_EXTERN int pam_sm_open_session(
         bool debug = false;
         int r;
 
-        r = DLOPEN_LIBPAM(LOG_DEBUG, required);
+        r = dlopen_libpam(LOG_DEBUG);
         if (r < 0)
                 return PAM_SERVICE_ERR;
 
@@ -908,7 +910,7 @@ _public_ PAM_EXTERN int pam_sm_close_session(
         bool debug = false;
         int r;
 
-        r = DLOPEN_LIBPAM(LOG_DEBUG, required);
+        r = dlopen_libpam(LOG_DEBUG);
         if (r < 0)
                 return PAM_SERVICE_ERR;
 
@@ -973,7 +975,7 @@ _public_ PAM_EXTERN int pam_sm_acct_mgmt(
         usec_t t;
         int r;
 
-        r = DLOPEN_LIBPAM(LOG_DEBUG, required);
+        r = dlopen_libpam(LOG_DEBUG);
         if (r < 0)
                 return PAM_SERVICE_ERR;
 
@@ -1092,7 +1094,7 @@ _public_ PAM_EXTERN int pam_sm_chauthtok(
         bool debug = false;
         int r;
 
-        r = DLOPEN_LIBPAM(LOG_DEBUG, required);
+        r = dlopen_libpam(LOG_DEBUG);
         if (r < 0)
                 return PAM_SERVICE_ERR;
 
diff --git a/src/imds/imdsd.c b/src/imds/imdsd.c
index 6eb1048034..8d532ee655 100644
--- a/src/imds/imdsd.c
+++ b/src/imds/imdsd.c
@@ -20,6 +20,7 @@
 #include "creds-util.h"
 #include "curl-util.h"
 #include "device-private.h"
+#include "dlopen-note.h"
 #include "dns-rr.h"
 #include "errno-util.h"
 #include "escape.h"
@@ -3047,13 +3048,15 @@ static int parse_proc_cmdline_item(const char *key, const char *value, void *dat
 static int run(int argc, char* argv[]) {
         int r;
 
+        LIBCURL_NOTE(required);
+
         log_setup();
 
         r = parse_argv(argc, argv);
         if (r <= 0)
                 return r;
 
-        r = DLOPEN_CURL(LOG_DEBUG, required);
+        r = dlopen_curl(LOG_DEBUG);
         if (r < 0)
                 return r;
 
diff --git a/src/import/import-common.c b/src/import/import-common.c
index 0168311204..ef2b3e26ba 100644
--- a/src/import/import-common.c
+++ b/src/import/import-common.c
@@ -31,7 +31,7 @@ int import_fork_tar_x(int tree_fd, int userns_fd, PidRef *ret_pid) {
         assert(tree_fd >= 0);
         assert(ret_pid);
 
-        r = DLOPEN_LIBARCHIVE(LOG_DEBUG, recommended);
+        r = dlopen_libarchive(LOG_DEBUG);
         if (r < 0)
                 return r;
 
@@ -99,7 +99,7 @@ int import_fork_tar_c(int tree_fd, int userns_fd, PidRef *ret_pid) {
         assert(tree_fd >= 0);
         assert(ret_pid);
 
-        r = DLOPEN_LIBARCHIVE(LOG_DEBUG, recommended);
+        r = dlopen_libarchive(LOG_DEBUG);
         if (r < 0)
                 return r;
 
diff --git a/src/import/pull-job.c b/src/import/pull-job.c
index d86c47039f..51714b1faa 100644
--- a/src/import/pull-job.c
+++ b/src/import/pull-job.c
@@ -281,7 +281,7 @@ static int pull_job_open_disk(PullJob *j) {
         }
 
         if (j->calc_checksum) {
-                r = DLOPEN_LIBCRYPTO(LOG_ERR, recommended);
+                r = dlopen_libcrypto(LOG_ERR);
                 if (r < 0)
                         return r;
 
diff --git a/src/import/pull.c b/src/import/pull.c
index 7fe3a7e4dd..92296c4fed 100644
--- a/src/import/pull.c
+++ b/src/import/pull.c
@@ -610,6 +610,7 @@ static int run(int argc, char *argv[]) {
         int r;
 
         ARCHIVE_NOTE(recommended);
+        LIBCRYPTO_NOTE(recommended);
         LIBCURL_NOTE(suggested);
         LIBSELINUX_NOTE(recommended);
 
diff --git a/src/integritysetup/integritysetup.c b/src/integritysetup/integritysetup.c
index f29fcda0ab..bf2f40b0d4 100644
--- a/src/integritysetup/integritysetup.c
+++ b/src/integritysetup/integritysetup.c
@@ -6,6 +6,7 @@
 #include "alloc-util.h"
 #include "argv-util.h"
 #include "cryptsetup-util.h"
+#include "dlopen-note.h"
 #include "fileio.h"
 #include "format-table.h"
 #include "help-util.h"
@@ -199,12 +200,14 @@ static int verb_detach(int argc, char *argv[], uintptr_t _data, void *userdata)
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBCRYPTSETUP_NOTE(required);
+
         if (argv_looks_like_help(argc, argv))
                 return help();
 
         log_setup();
 
-        r = DLOPEN_CRYPTSETUP(LOG_ERR, required);
+        r = dlopen_cryptsetup(LOG_ERR);
         if (r < 0)
                 return r;
 
diff --git a/src/journal-remote/journal-gatewayd.c b/src/journal-remote/journal-gatewayd.c
index 8a6e59c8d7..f2fd083c8a 100644
--- a/src/journal-remote/journal-gatewayd.c
+++ b/src/journal-remote/journal-gatewayd.c
@@ -1261,6 +1261,7 @@ static int run(int argc, char *argv[]) {
 
         COMPRESS_JOURNAL_NOTE;
         LIBGNUTLS_NOTE(suggested);
+        LIBMICROHTTPD_NOTE(required);
 
         log_setup();
 
@@ -1268,7 +1269,7 @@ static int run(int argc, char *argv[]) {
         if (r <= 0)
                 return r;
 
-        r = DLOPEN_MICROHTTPD(LOG_ERR, required);
+        r = dlopen_microhttpd(LOG_ERR);
         if (r < 0)
                 return r;
 
diff --git a/src/journal-remote/journal-remote-main.c b/src/journal-remote/journal-remote-main.c
index afa4e55edf..30757201f3 100644
--- a/src/journal-remote/journal-remote-main.c
+++ b/src/journal-remote/journal-remote-main.c
@@ -469,7 +469,7 @@ static int setup_microhttpd_server(RemoteServer *s,
 #if HAVE_MICROHTTPD
         int r;
 
-        r = DLOPEN_MICROHTTPD(LOG_ERR, required);
+        r = dlopen_microhttpd(LOG_ERR);
         if (r < 0)
                 return r;
 
@@ -1170,6 +1170,7 @@ static int run(int argc, char **argv) {
         COMPRESS_DEFAULT_NOTE;
         LIBCRYPTO_NOTE(suggested);
         LIBGNUTLS_NOTE(suggested);
+        LIBMICROHTTPD_NOTE(required);
         LIBSELINUX_NOTE(recommended);
 
         log_setup();
diff --git a/src/journal-remote/journal-upload.c b/src/journal-remote/journal-upload.c
index 48a8df559e..d680a4c02b 100644
--- a/src/journal-remote/journal-upload.c
+++ b/src/journal-remote/journal-upload.c
@@ -871,6 +871,7 @@ static int run(int argc, char **argv) {
         int r;
 
         COMPRESS_DEFAULT_NOTE;
+        LIBCURL_NOTE(required);
 
         log_setup();
 
@@ -882,7 +883,7 @@ static int run(int argc, char **argv) {
         if (r <= 0)
                 return r;
 
-        r = DLOPEN_CURL(LOG_DEBUG, required);
+        r = dlopen_curl(LOG_DEBUG);
         if (r < 0)
                 return r;
 
diff --git a/src/journal/journalctl-authenticate.c b/src/journal/journalctl-authenticate.c
index 180291ce34..3484aba544 100644
--- a/src/journal/journalctl-authenticate.c
+++ b/src/journal/journalctl-authenticate.c
@@ -70,7 +70,7 @@ int action_setup_keys(void) {
 
         assert(arg_action == ACTION_SETUP_KEYS);
 
-        r = DLOPEN_LIBCRYPTO(LOG_ERR, recommended);
+        r = dlopen_libcrypto(LOG_ERR);
         if (r < 0)
                 return r;
 
diff --git a/src/journal/journalctl.c b/src/journal/journalctl.c
index 4bc648ceff..ce9470cf76 100644
--- a/src/journal/journalctl.c
+++ b/src/journal/journalctl.c
@@ -1035,6 +1035,7 @@ static int run(int argc, char *argv[]) {
         COMPRESS_JOURNAL_NOTE;
         LIBACL_NOTE(recommended);
         LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(recommended);
         LIBCRYPTSETUP_NOTE(suggested);
         LIBMOUNT_NOTE(recommended);
         LIBPCRE2_NOTE(suggested);
diff --git a/src/keyutil/keyutil.c b/src/keyutil/keyutil.c
index 4915e9c95d..51c83478eb 100644
--- a/src/keyutil/keyutil.c
+++ b/src/keyutil/keyutil.c
@@ -4,6 +4,7 @@
 #include "ask-password-api.h"
 #include "build.h"
 #include "crypto-util.h"
+#include "dlopen-note.h"
 #include "fd-util.h"
 #include "fileio.h"
 #include "format-table.h"
@@ -233,7 +234,7 @@ static int verb_extract_public(int argc, char *argv[], uintptr_t _data, void *us
                                 return r;
                 }
 
-                r = DLOPEN_LIBCRYPTO(LOG_ERR, required);
+                r = dlopen_libcrypto(LOG_ERR);
                 if (r < 0)
                         return r;
 
@@ -405,6 +406,8 @@ static int verb_pkcs7(int argc, char *argv[], uintptr_t _data, void *userdata) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBCRYPTO_NOTE(required);
+
         log_setup();
 
         char **args = NULL;
diff --git a/src/login/pam_systemd.c b/src/login/pam_systemd.c
index fa603ba015..6b5ee9afba 100644
--- a/src/login/pam_systemd.c
+++ b/src/login/pam_systemd.c
@@ -1807,7 +1807,8 @@ _public_ PAM_EXTERN int pam_sm_open_session(
 
         assert(pamh);
 
-        r = DLOPEN_LIBPAM(LOG_DEBUG, required);
+        LIBPAM_NOTE(required);
+        r = dlopen_libpam(LOG_DEBUG);
         if (r < 0)
                 return PAM_SERVICE_ERR;
 
@@ -1915,7 +1916,7 @@ _public_ PAM_EXTERN int pam_sm_close_session(
 
         assert(pamh);
 
-        r = DLOPEN_LIBPAM(LOG_DEBUG, required);
+        r = dlopen_libpam(LOG_DEBUG);
         if (r < 0)
                 return PAM_SERVICE_ERR;
 
diff --git a/src/login/pam_systemd_loadkey.c b/src/login/pam_systemd_loadkey.c
index ee17e650a7..41afb8ba23 100644
--- a/src/login/pam_systemd_loadkey.c
+++ b/src/login/pam_systemd_loadkey.c
@@ -19,7 +19,8 @@ _public_ PAM_EXTERN int pam_sm_authenticate(
 
         assert(pamh);
 
-        r = DLOPEN_LIBPAM(LOG_DEBUG, required);
+        LIBPAM_NOTE(required);
+        r = dlopen_libpam(LOG_DEBUG);
         if (r < 0)
                 return PAM_SERVICE_ERR;
 
diff --git a/src/measure/measure-tool.c b/src/measure/measure-tool.c
index b224f95b35..bcd20743ed 100644
--- a/src/measure/measure-tool.c
+++ b/src/measure/measure-tool.c
@@ -179,7 +179,7 @@ static int parse_argv(int argc, char *argv[], char ***ret_args) {
                             "Select TPM bank (SHA1, SHA256, SHA384, SHA512)"): {
                         const EVP_MD *implementation;
 
-                        r = DLOPEN_LIBCRYPTO(LOG_ERR, required);
+                        r = dlopen_libcrypto(LOG_ERR);
                         if (r < 0)
                                 return r;
 
@@ -1131,6 +1131,7 @@ static int verb_policy_digest(int argc, char *argv[], uintptr_t _data, void *use
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBCRYPTO_NOTE(required);
         TPM2_NOTE(suggested);
 
         log_setup();
@@ -1140,7 +1141,7 @@ static int run(int argc, char *argv[]) {
         if (r <= 0)
                 return r;
 
-        r = DLOPEN_LIBCRYPTO(LOG_ERR, required);
+        r = dlopen_libcrypto(LOG_ERR);
         if (r < 0)
                 return r;
 
diff --git a/src/network/networkd-sysctl.c b/src/network/networkd-sysctl.c
index 887ef5d179..ca58a1815e 100644
--- a/src/network/networkd-sysctl.c
+++ b/src/network/networkd-sysctl.c
@@ -108,7 +108,8 @@ int manager_install_sysctl_monitor(Manager *manager) {
 
         assert(manager);
 
-        r = DLOPEN_BPF(LOG_DEBUG, recommended);
+        LIBBPF_NOTE(recommended);
+        r = dlopen_bpf(LOG_DEBUG);
         if (ERRNO_IS_NEG_NOT_SUPPORTED(r))
                 return log_debug_errno(r, "sysctl monitor disabled, as BPF support is not available.");
         if (r < 0)
diff --git a/src/nspawn/nspawn-oci.c b/src/nspawn/nspawn-oci.c
index e113a6097b..545f80f8ed 100644
--- a/src/nspawn/nspawn-oci.c
+++ b/src/nspawn/nspawn-oci.c
@@ -1826,7 +1826,7 @@ static int oci_seccomp(const char *name, sd_json_variant *v, sd_json_dispatch_fl
         if (r < 0)
                 return json_log(def, flags, r, "Unknown default action: %s", sd_json_variant_string(def));
 
-        r = DLOPEN_LIBSECCOMP(LOG_DEBUG, recommended);
+        r = dlopen_libseccomp(LOG_DEBUG);
         if (r < 0)
                 return json_log(def, flags, r, "No support for libseccomp: %m");
 
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index 959aef9b71..2b2083a818 100644
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -45,6 +45,7 @@
 #include "devnum-util.h"
 #include "discover-image.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "escape.h"
 #include "ether-addr-util.h"
@@ -6148,13 +6149,20 @@ static int run(int argc, char *argv[]) {
         if (arg_cleanup)
                 return do_cleanup();
 
-        (void) DLOPEN_CRYPTSETUP(LOG_DEBUG, suggested);
-        (void) DLOPEN_LIBACL(LOG_DEBUG, recommended);
-        (void) DLOPEN_LIBBLKID(LOG_DEBUG, recommended);
-        (void) DLOPEN_LIBCRYPTO(LOG_WARNING, recommended);
-        (void) DLOPEN_LIBMOUNT(LOG_DEBUG, recommended);
-        (void) DLOPEN_LIBSECCOMP(LOG_DEBUG, recommended);
-        (void) DLOPEN_LIBSELINUX(LOG_DEBUG, recommended);
+        LIBACL_NOTE(recommended);
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(recommended);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBSECCOMP_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+        (void) dlopen_cryptsetup(LOG_DEBUG);
+        (void) dlopen_libacl(LOG_DEBUG);
+        (void) dlopen_libblkid(LOG_DEBUG);
+        (void) dlopen_libcrypto(LOG_WARNING);
+        (void) dlopen_libmount(LOG_DEBUG);
+        (void) dlopen_libseccomp(LOG_DEBUG);
+        (void) dlopen_libselinux(LOG_DEBUG);
 
         r = cg_has_legacy();
         if (r < 0)
diff --git a/src/nsresourced/userns-restrict.c b/src/nsresourced/userns-restrict.c
index dc2ab9b67e..99f5223671 100644
--- a/src/nsresourced/userns-restrict.c
+++ b/src/nsresourced/userns-restrict.c
@@ -68,7 +68,8 @@ int userns_restrict_install(
         if (r == 0)
                 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "bpf-lsm not supported, can't lock down user namespace.");
 
-        r = DLOPEN_BPF(LOG_DEBUG, recommended);
+        LIBBPF_NOTE(recommended);
+        r = dlopen_bpf(LOG_DEBUG);
         if (r < 0)
                 return r;
 
diff --git a/src/pcrextend/pcrextend.c b/src/pcrextend/pcrextend.c
index 5a98d66b6c..b32a5c708b 100644
--- a/src/pcrextend/pcrextend.c
+++ b/src/pcrextend/pcrextend.c
@@ -91,7 +91,7 @@ static int parse_argv(int argc, char *argv[], char ***ret_args) {
                 OPTION_LONG("bank", "DIGEST", "Select TPM PCR bank (SHA1, SHA256)"): {
                         const EVP_MD *implementation;
 
-                        r = DLOPEN_LIBCRYPTO(LOG_ERR, required);
+                        r = dlopen_libcrypto(LOG_ERR);
                         if (r < 0)
                                 return r;
 
@@ -508,6 +508,7 @@ static int run(int argc, char *argv[]) {
         int r;
 
         LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(required);
         TPM2_NOTE(suggested);
 
         log_setup();
diff --git a/src/pcrlock/pcrlock.c b/src/pcrlock/pcrlock.c
index cb39737b1e..ecb0bb30e6 100644
--- a/src/pcrlock/pcrlock.c
+++ b/src/pcrlock/pcrlock.c
@@ -5708,6 +5708,7 @@ static int run(int argc, char *argv[]) {
         int r;
 
         LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(required);
         LIBSELINUX_NOTE(recommended);
         TPM2_NOTE(suggested);
 
@@ -5722,7 +5723,7 @@ static int run(int argc, char *argv[]) {
         if (r <= 0)
                 return r;
 
-        r = DLOPEN_LIBCRYPTO(LOG_ERR, required);
+        r = dlopen_libcrypto(LOG_ERR);
         if (r < 0)
                 return r;
 
diff --git a/src/portable/portable.c b/src/portable/portable.c
index c2691b6ff9..7c21187caa 100644
--- a/src/portable/portable.c
+++ b/src/portable/portable.c
@@ -610,8 +610,8 @@ static int portable_extract_by_path(
                  * there, and extract the metadata we need. The metadata is sent from the child back to us. */
 
                 /* Load some libraries before we fork workers off that want to use them */
-                (void) DLOPEN_CRYPTSETUP(LOG_DEBUG, recommended);
-                (void) DLOPEN_LIBMOUNT(LOG_DEBUG, required);
+                (void) dlopen_cryptsetup(LOG_DEBUG);
+                (void) dlopen_libmount(LOG_DEBUG);
 
                 r = mkdtemp_malloc("/tmp/inspect-XXXXXX", &tmpdir);
                 if (r < 0)
diff --git a/src/portable/portabled.c b/src/portable/portabled.c
index 2a8bdc36c7..b79491e2d8 100644
--- a/src/portable/portabled.c
+++ b/src/portable/portabled.c
@@ -146,6 +146,8 @@ static int run(int argc, char *argv[]) {
 
         LIBBLKID_NOTE(recommended);
         LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(recommended);
+        LIBMOUNT_NOTE(required);
         LIBSELINUX_NOTE(recommended);
 
         log_setup();
diff --git a/src/repart/repart.c b/src/repart/repart.c
index bd8df61263..140c2913dd 100644
--- a/src/repart/repart.c
+++ b/src/repart/repart.c
@@ -3108,7 +3108,7 @@ static int partition_read_definition(
                                   "Cannot format %s filesystem without source files, refusing.", p->format);
 
         if (p->verity != VERITY_OFF || p->encrypt != ENCRYPT_OFF) {
-                r = DLOPEN_CRYPTSETUP(LOG_DEBUG, recommended);
+                r = dlopen_cryptsetup(LOG_DEBUG);
                 if (r < 0)
                         return log_syntax(NULL, LOG_ERR, path, 1, r,
                                           "libcryptsetup not found, Verity=/Encrypt= are not supported: %m");
@@ -4758,7 +4758,7 @@ static int context_wipe_range(Context *context, uint64_t offset, uint64_t size)
         assert(offset != UINT64_MAX);
         assert(size != UINT64_MAX);
 
-        r = DLOPEN_LIBBLKID(LOG_ERR, required);
+        r = dlopen_libblkid(LOG_ERR);
         if (r < 0)
                 return r;
 
@@ -5459,7 +5459,7 @@ static int partition_encrypt(Context *context, Partition *p, PartitionTarget *ta
         assert(p);
         assert(p->encrypt != ENCRYPT_OFF);
 
-        r = DLOPEN_CRYPTSETUP(LOG_ERR, recommended);
+        r = dlopen_cryptsetup(LOG_ERR);
         if (r < 0)
                 return r;
 
@@ -6002,7 +6002,7 @@ static int partition_format_verity_hash(
 
         (void) partition_hint(p, node, &hint);
 
-        r = DLOPEN_CRYPTSETUP(LOG_ERR, recommended);
+        r = dlopen_cryptsetup(LOG_ERR);
         if (r < 0)
                 return r;
 
@@ -6107,7 +6107,7 @@ static int sign_verity_roothash(
         assert(iovec_is_set(roothash));
         assert(ret_signature);
 
-        r = DLOPEN_LIBCRYPTO(LOG_ERR, recommended);
+        r = dlopen_libcrypto(LOG_ERR);
         if (r < 0)
                 return r;
 
@@ -7218,7 +7218,7 @@ static int partition_populate_filesystem(Context *context, Partition *p, const c
          * appear in the host namespace. Hence we fork a child that has its own file system namespace and
          * detached mount propagation. */
 
-        (void) DLOPEN_LIBMOUNT(LOG_DEBUG, required);
+        (void) dlopen_libmount(LOG_DEBUG);
 
         r = pidref_safe_fork(
                         "(sd-copy)",
@@ -8854,7 +8854,7 @@ static int resolve_copy_blocks_auto_candidate(
                 return log_error_errno(r, "Failed to open block device " DEVNUM_FORMAT_STR ": %m",
                                        DEVNUM_FORMAT_VAL(whole_devno));
 
-        r = DLOPEN_LIBBLKID(LOG_ERR, required);
+        r = dlopen_libblkid(LOG_ERR);
         if (r < 0)
                 return r;
 
@@ -11696,6 +11696,11 @@ static int run(int argc, char *argv[]) {
         bool node_is_our_loop = false;
         int r;
 
+        LIBBLKID_NOTE(required);
+        LIBCRYPTO_NOTE(recommended);
+        LIBCRYPTSETUP_NOTE(recommended);
+        LIBFDISK_NOTE(required);
+        LIBMOUNT_NOTE(required);
         LIBSELINUX_NOTE(recommended);
         TPM2_NOTE(suggested);
 
@@ -11705,7 +11710,7 @@ static int run(int argc, char *argv[]) {
         if (r <= 0)
                 return r;
 
-        r = DLOPEN_FDISK(LOG_ERR, required);
+        r = dlopen_fdisk(LOG_ERR);
         if (r < 0)
                 return r;
 
diff --git a/src/report/report-sign-plain.c b/src/report/report-sign-plain.c
index 41b342cad6..45f4c86cd6 100644
--- a/src/report/report-sign-plain.c
+++ b/src/report/report-sign-plain.c
@@ -9,6 +9,7 @@
 #include "alloc-util.h"
 #include "build.h"
 #include "crypto-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "fd-util.h"
 #include "fileio.h"
@@ -304,7 +305,7 @@ static int vl_server(void) {
         _cleanup_(sd_varlink_server_unrefp) sd_varlink_server *vs = NULL;
         int r;
 
-        r = DLOPEN_LIBCRYPTO(LOG_ERR, required);
+        r = dlopen_libcrypto(LOG_ERR);
         if (r < 0)
                 return r;
 
@@ -391,6 +392,8 @@ static int parse_argv(int argc, char *argv[]) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBCRYPTO_NOTE(required);
+
         log_setup();
 
         r = parse_argv(argc, argv);
diff --git a/src/report/report-upload.c b/src/report/report-upload.c
index 01981c3ecf..4178e8de33 100644
--- a/src/report/report-upload.c
+++ b/src/report/report-upload.c
@@ -64,7 +64,7 @@ static int http_upload_report(Context *context, sd_json_variant *report) {
         char error[CURL_ERROR_SIZE] = {};
         int r;
 
-        r = DLOPEN_CURL(LOG_DEBUG, required);
+        r = dlopen_curl(LOG_DEBUG);
         if (r < 0)
                 return r;
 
diff --git a/src/report/report.c b/src/report/report.c
index c3b014a008..8b756e0c2d 100644
--- a/src/report/report.c
+++ b/src/report/report.c
@@ -7,6 +7,7 @@
 #include "build.h"
 #include "chase.h"
 #include "dirent-util.h"
+#include "dlopen-note.h"
 #include "format-table.h"
 #include "help-util.h"
 #include "log.h"
@@ -1024,6 +1025,8 @@ static int run(int argc, char *argv[]) {
         char **args = NULL;
         int r;
 
+        LIBCURL_NOTE(required);
+
         log_setup();
 
         /* If invoked as a socket-activated Varlink service (Accept=yes), act as the io.systemd.Report
diff --git a/src/resolve/resolvectl.c b/src/resolve/resolvectl.c
index ea6ee54ba6..853df2a987 100644
--- a/src/resolve/resolvectl.c
+++ b/src/resolve/resolvectl.c
@@ -3794,6 +3794,7 @@ static int run(int argc, char **argv) {
         int r;
 
         LIBCRYPTO_NOTE(suggested);
+        LIBIDN2_NOTE(recommended);
 
         setlocale(LC_ALL, "");
         log_setup();
diff --git a/src/resolve/resolved-dns-dnssec.c b/src/resolve/resolved-dns-dnssec.c
index c8821f189c..0e234111d3 100644
--- a/src/resolve/resolved-dns-dnssec.c
+++ b/src/resolve/resolved-dns-dnssec.c
@@ -735,7 +735,7 @@ int dnssec_verify_rrset(
         assert(dnskey);
         assert(result);
 
-        r = DLOPEN_LIBCRYPTO(LOG_WARNING, recommended);
+        r = dlopen_libcrypto(LOG_WARNING);
         if (r < 0)
                 return r;
 
@@ -1092,7 +1092,7 @@ int dnssec_verify_dnskey_by_ds(DnsResourceRecord *dnskey, DnsResourceRecord *ds,
         assert(dnskey);
         assert(ds);
 
-        r = DLOPEN_LIBCRYPTO(LOG_WARNING, recommended);
+        r = dlopen_libcrypto(LOG_WARNING);
         if (r < 0)
                 return r;
 
@@ -1232,7 +1232,7 @@ int dnssec_nsec3_hash(DnsResourceRecord *nsec3, const char *name, void *ret) {
         assert(name);
         assert(ret);
 
-        r = DLOPEN_LIBCRYPTO(LOG_WARNING, recommended);
+        r = dlopen_libcrypto(LOG_WARNING);
         if (r < 0)
                 return r;
 
diff --git a/src/resolve/resolved-dnstls.c b/src/resolve/resolved-dnstls.c
index a8d823af1e..7819c61838 100644
--- a/src/resolve/resolved-dnstls.c
+++ b/src/resolve/resolved-dnstls.c
@@ -412,11 +412,11 @@ int dnstls_manager_init(Manager *manager) {
         if (manager->dnstls_data.ctx)
                 return 0;
 
-        r = DLOPEN_LIBCRYPTO(LOG_WARNING, recommended);
+        r = dlopen_libcrypto(LOG_WARNING);
         if (r < 0)
                 return r;
 
-        r = DLOPEN_LIBSSL(LOG_WARNING, recommended);
+        r = dlopen_libssl(LOG_WARNING);
         if (r < 0)
                 return r;
 
diff --git a/src/resolve/resolved-util.c b/src/resolve/resolved-util.c
index 6fd6c049f9..094ef00698 100644
--- a/src/resolve/resolved-util.c
+++ b/src/resolve/resolved-util.c
@@ -36,7 +36,7 @@ int resolve_system_hostname(char **full_hostname, char **first_label) {
 #if HAVE_LIBIDN2
         _cleanup_free_ char *utf8 = NULL;
 
-        if (DLOPEN_IDN(LOG_DEBUG, recommended) >= 0) {
+        if (dlopen_idn(LOG_DEBUG) >= 0) {
                 r = sym_idn2_to_unicode_8z8z(label, &utf8, 0);
                 if (r != IDN2_OK)
                         return log_debug_errno(SYNTHETIC_ERRNO(EUCLEAN),
diff --git a/src/resolve/resolved.c b/src/resolve/resolved.c
index ba487c9172..0b6e3e983d 100644
--- a/src/resolve/resolved.c
+++ b/src/resolve/resolved.c
@@ -25,7 +25,10 @@ static int run(int argc, char *argv[]) {
         _unused_ _cleanup_(notify_on_cleanup) const char *notify_stop = NULL;
         int r;
 
+        LIBCRYPTO_NOTE(recommended);
+        LIBIDN2_NOTE(recommended);
         LIBSELINUX_NOTE(recommended);
+        LIBSSL_NOTE(recommended);
 
         log_setup();
 
diff --git a/src/sbsign/sbsign.c b/src/sbsign/sbsign.c
index d7eb9a6f21..bed464e8ce 100644
--- a/src/sbsign/sbsign.c
+++ b/src/sbsign/sbsign.c
@@ -9,6 +9,7 @@
 #include "build.h"
 #include "copy.h"
 #include "crypto-util.h"
+#include "dlopen-note.h"
 #include "efi.h"
 #include "fd-util.h"
 #include "fileio.h"
@@ -406,7 +407,7 @@ static int verb_sign(int argc, char *argv[], uintptr_t _data, void *userdata) {
         _cleanup_(iovec_done) struct iovec signed_attributes_signature = {};
         int r;
 
-        r = DLOPEN_LIBCRYPTO(LOG_ERR, required);
+        r = dlopen_libcrypto(LOG_ERR);
         if (r < 0)
                 return r;
 
@@ -697,6 +698,8 @@ static int verb_sign(int argc, char *argv[], uintptr_t _data, void *userdata) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBCRYPTO_NOTE(required);
+
         log_setup();
 
         char **args = NULL;
diff --git a/src/shared/acl-util.h b/src/shared/acl-util.h
index 93066301da..c1eebac805 100644
--- a/src/shared/acl-util.h
+++ b/src/shared/acl-util.h
@@ -99,12 +99,6 @@ static inline int fd_add_uid_acl_permission(int fd, uid_t uid, unsigned mask) {
 
 int dlopen_libacl(int log_level) _dlopen_loader_;
 
-#define DLOPEN_LIBACL(log_level, priority)                              \
-        ({                                                              \
-                LIBACL_NOTE(priority);                                  \
-                dlopen_libacl(log_level);                               \
-        })
-
 int fd_acl_make_read_only(int fd);
 int fd_acl_make_writable(int fd);
 
diff --git a/src/shared/blkid-util.h b/src/shared/blkid-util.h
index 0f3175d616..41eb591d1f 100644
--- a/src/shared/blkid-util.h
+++ b/src/shared/blkid-util.h
@@ -70,9 +70,3 @@ int blkid_probe_lookup_value_u64(blkid_probe b, const char *field, uint64_t *ret
 #endif
 
 int dlopen_libblkid(int log_level) _dlopen_loader_;
-
-#define DLOPEN_LIBBLKID(log_level, priority)                            \
-        ({                                                              \
-                LIBBLKID_NOTE(priority);                                \
-                dlopen_libblkid(log_level);                             \
-        })
diff --git a/src/shared/bpf-util.h b/src/shared/bpf-util.h
index b21cce18bb..45c264773f 100644
--- a/src/shared/bpf-util.h
+++ b/src/shared/bpf-util.h
@@ -95,9 +95,3 @@ int bpf_get_error_translated(const void *ptr);
 #endif
 
 int dlopen_bpf(int log_level) _dlopen_loader_;
-
-#define DLOPEN_BPF(log_level, priority)                                 \
-        ({                                                              \
-                LIBBPF_NOTE(priority);                                  \
-                dlopen_bpf(log_level);                                  \
-        })
diff --git a/src/shared/crypto-util.h b/src/shared/crypto-util.h
index 17d29b8915..b0ed8cc36b 100644
--- a/src/shared/crypto-util.h
+++ b/src/shared/crypto-util.h
@@ -449,12 +449,6 @@ DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(OpenSSLAskPasswordUI*, openssl_ask_password_ui_
 int dlopen_libcrypto(int log_level) _dlopen_loader_;
 bool dlopen_libcrypto_has_argon2id(void);
 
-#define DLOPEN_LIBCRYPTO(log_level, priority)                           \
-        ({                                                              \
-                LIBCRYPTO_NOTE(priority);                               \
-                dlopen_libcrypto(log_level);                            \
-        })
-
 typedef struct Argon2IdParameters {
         uint64_t memcost_bytes;
         uint32_t iterations;
diff --git a/src/shared/cryptsetup-util.h b/src/shared/cryptsetup-util.h
index 2e49c35d92..0a293c87ba 100644
--- a/src/shared/cryptsetup-util.h
+++ b/src/shared/cryptsetup-util.h
@@ -101,12 +101,6 @@ int cryptsetup_get_volume_key_id(struct crypt_device *cd, const char *volume_nam
 
 int dlopen_cryptsetup(int log_level) _dlopen_loader_;
 
-#define DLOPEN_CRYPTSETUP(log_level, priority)                          \
-        ({                                                              \
-                LIBCRYPTSETUP_NOTE(priority);                           \
-                dlopen_cryptsetup(log_level);                           \
-        })
-
 int cryptsetup_get_keyslot_from_token(sd_json_variant *v);
 
 const char* mangle_none(const char *s);
diff --git a/src/shared/curl-util.h b/src/shared/curl-util.h
index d3d4e21c86..d728c3b1b9 100644
--- a/src/shared/curl-util.h
+++ b/src/shared/curl-util.h
@@ -78,9 +78,3 @@ DEFINE_TRIVIAL_CLEANUP_FUNC_FULL_RENAME(struct curl_slist*, sym_curl_slist_free_
 #endif
 
 int dlopen_curl(int log_level) _dlopen_loader_;
-
-#define DLOPEN_CURL(log_level, priority)                                \
-        ({                                                              \
-                LIBCURL_NOTE(priority);                                 \
-                dlopen_curl(log_level);                                 \
-        })
diff --git a/src/shared/fdisk-util.h b/src/shared/fdisk-util.h
index 6f6ae6b438..289ca71d63 100644
--- a/src/shared/fdisk-util.h
+++ b/src/shared/fdisk-util.h
@@ -90,9 +90,3 @@ int fdisk_partition_set_attrs_as_uint64(struct fdisk_partition *pa, uint64_t fla
 #endif
 
 int dlopen_fdisk(int log_level) _dlopen_loader_;
-
-#define DLOPEN_FDISK(log_level, priority)                               \
-        ({                                                              \
-                LIBFDISK_NOTE(priority);                                \
-                dlopen_fdisk(log_level);                                \
-        })
diff --git a/src/shared/idn-util.h b/src/shared/idn-util.h
index 945b7cd927..08af93fdff 100644
--- a/src/shared/idn-util.h
+++ b/src/shared/idn-util.h
@@ -19,9 +19,3 @@ extern DLSYM_PROTOTYPE(idn2_to_unicode_8z8z);
 #endif
 
 int dlopen_idn(int log_level) _dlopen_loader_;
-
-#define DLOPEN_IDN(log_level, priority)                                 \
-        ({                                                              \
-                LIBIDN2_NOTE(priority);                                 \
-                dlopen_idn(log_level);                                  \
-        })
diff --git a/src/shared/libarchive-util.h b/src/shared/libarchive-util.h
index 77971236fa..e797e1d675 100644
--- a/src/shared/libarchive-util.h
+++ b/src/shared/libarchive-util.h
@@ -86,9 +86,3 @@ DEFINE_TRIVIAL_CLEANUP_FUNC_FULL_RENAME(struct archive*, sym_archive_read_free,
 #endif
 
 int dlopen_libarchive(int log_level) _dlopen_loader_;
-
-#define DLOPEN_LIBARCHIVE(log_level, priority)                          \
-        ({                                                              \
-                LIBARCHIVE_NOTE(priority);                              \
-                dlopen_libarchive(log_level);                           \
-        })
diff --git a/src/shared/libmount-util.h b/src/shared/libmount-util.h
index 6352b84eb5..056a67da21 100644
--- a/src/shared/libmount-util.h
+++ b/src/shared/libmount-util.h
@@ -89,9 +89,3 @@ static inline void* sym_mnt_unref_monitor(struct libmnt_monitor *p) {
 #endif
 
 int dlopen_libmount(int log_level) _dlopen_loader_;
-
-#define DLOPEN_LIBMOUNT(log_level, priority)                            \
-        ({                                                              \
-                LIBMOUNT_NOTE(priority);                                \
-                dlopen_libmount(log_level);                             \
-        })
diff --git a/src/shared/microhttpd-util.h b/src/shared/microhttpd-util.h
index 20fd2545ae..4c5fafc8d3 100644
--- a/src/shared/microhttpd-util.h
+++ b/src/shared/microhttpd-util.h
@@ -138,9 +138,3 @@ DEFINE_TRIVIAL_CLEANUP_FUNC_FULL_RENAME(struct MHD_Response*, sym_MHD_destroy_re
 #endif
 
 int dlopen_microhttpd(int log_level) _dlopen_loader_;
-
-#define DLOPEN_MICROHTTPD(log_level, priority)                          \
-        ({                                                              \
-                LIBMICROHTTPD_NOTE(priority);                           \
-                dlopen_microhttpd(log_level);                           \
-        })
diff --git a/src/shared/module-util.h b/src/shared/module-util.h
index 5dd3d475dc..fcd103b556 100644
--- a/src/shared/module-util.h
+++ b/src/shared/module-util.h
@@ -54,9 +54,3 @@ static inline int module_load_and_warn(struct kmod_ctx *ctx, const char *module,
 #endif
 
 int dlopen_libkmod(int log_level) _dlopen_loader_;
-
-#define DLOPEN_LIBKMOD(log_level, priority)                             \
-        ({                                                              \
-                LIBKMOD_NOTE(priority);                                 \
-                dlopen_libkmod(log_level);                              \
-        })
diff --git a/src/shared/pam-util.h b/src/shared/pam-util.h
index ed085fa771..fdfddef0f4 100644
--- a/src/shared/pam-util.h
+++ b/src/shared/pam-util.h
@@ -111,9 +111,3 @@ int pam_putenv_assign(pam_handle_t *pamh, const char *name, const char *value);
 #endif
 
 int dlopen_libpam(int log_level) _dlopen_loader_;
-
-#define DLOPEN_LIBPAM(log_level, priority)                              \
-        ({                                                              \
-                LIBPAM_NOTE(priority);                                  \
-                dlopen_libpam(log_level);                               \
-        })
diff --git a/src/shared/seccomp-util.h b/src/shared/seccomp-util.h
index fc164488c5..699d819ecc 100644
--- a/src/shared/seccomp-util.h
+++ b/src/shared/seccomp-util.h
@@ -166,17 +166,10 @@ static inline bool is_seccomp_available(void) {
         return false;
 }
 
-
 #endif
 
 int dlopen_libseccomp(int log_level) _dlopen_loader_;
 
-#define DLOPEN_LIBSECCOMP(log_level, priority)                          \
-        ({                                                              \
-                LIBSECCOMP_NOTE(priority);                              \
-                dlopen_libseccomp(log_level);                           \
-        })
-
 /* This is a special value to be used where syscall filters otherwise expect errno numbers, will be
    replaced with real seccomp action. */
 enum {
diff --git a/src/shared/selinux-util.h b/src/shared/selinux-util.h
index ed76e6532e..d361963344 100644
--- a/src/shared/selinux-util.h
+++ b/src/shared/selinux-util.h
@@ -65,12 +65,6 @@ static inline void freeconp(char **p) {
 
 int dlopen_libselinux(int log_level) _dlopen_loader_;
 
-#define DLOPEN_LIBSELINUX(log_level, priority)                          \
-        ({                                                              \
-                LIBSELINUX_NOTE(priority);                              \
-                dlopen_libselinux(log_level);                           \
-        })
-
 #define _cleanup_freecon_ _cleanup_(freeconp)
 
 /* This accepts 0 error, like _zerook(). */
diff --git a/src/shared/ssl-util.h b/src/shared/ssl-util.h
index 16096ff426..0058628894 100644
--- a/src/shared/ssl-util.h
+++ b/src/shared/ssl-util.h
@@ -48,9 +48,3 @@ DEFINE_TRIVIAL_CLEANUP_FUNC_FULL_RENAME(SSL_CTX*, sym_SSL_CTX_free, SSL_CTX_free
 #endif
 
 int dlopen_libssl(int log_level) _dlopen_loader_;
-
-#define DLOPEN_LIBSSL(log_level, priority)                              \
-        ({                                                              \
-                LIBSSL_NOTE(priority);                                  \
-                dlopen_libssl(log_level);                               \
-        })
diff --git a/src/shared/tpm2-util.h b/src/shared/tpm2-util.h
index 982a0862cb..d8da991784 100644
--- a/src/shared/tpm2-util.h
+++ b/src/shared/tpm2-util.h
@@ -59,12 +59,6 @@ int dlopen_tpm2(int log_level) _dlopen_loader_;
  * other tokens. */
 #define ERRNO_IS_NEG_TPM2_TOKEN_MISMATCH(r) IN_SET(r, -EREMCHG, -ENOANO, -EPERM, -ENOSTR, -EREMOTE, -EADDRNOTAVAIL)
 
-#define DLOPEN_TPM2(log_level, priority)                                \
-        ({                                                              \
-                TPM2_NOTE(priority);                                    \
-                dlopen_tpm2(log_level);                                 \
-        })
-
 #if HAVE_TPM2
 #ifndef SYSTEMD_CFLAGS_MARKER_TPM2
 #  error "missing tpm2_cflags in meson dependency."
diff --git a/src/shutdown/detach-swap.c b/src/shutdown/detach-swap.c
index 9584284a56..04efbfeb36 100644
--- a/src/shutdown/detach-swap.c
+++ b/src/shutdown/detach-swap.c
@@ -36,7 +36,7 @@ int swap_list_get(const char *swaps, SwapDevice **head) {
 
         assert(head);
 
-        r = DLOPEN_LIBMOUNT(LOG_ERR, recommended);
+        r = dlopen_libmount(LOG_ERR);
         if (r < 0)
                 return r;
 
diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c
index 17f526b727..ebf011f7a7 100644
--- a/src/shutdown/shutdown.c
+++ b/src/shutdown/shutdown.c
@@ -379,6 +379,7 @@ int main(int argc, char *argv[]) {
         size_t n_luo_fds = 0;
         int cmd, r;
 
+        LIBMOUNT_NOTE(recommended);
         LIBSELINUX_NOTE(recommended);
 
         /* LUO will preserve these across kexec */
diff --git a/src/sysext/sysext.c b/src/sysext/sysext.c
index 0cb55a5361..986c0b51e9 100644
--- a/src/sysext/sysext.c
+++ b/src/sysext/sysext.c
@@ -1914,7 +1914,7 @@ static int unmerge(const Context *c) {
 
         assert(c);
 
-        (void) DLOPEN_LIBMOUNT(LOG_DEBUG, required);
+        (void) dlopen_libmount(LOG_DEBUG);
 
         r = get_extension_release_metadata(c, &need_to_reload, &units_to_restart, &units_to_reload_or_restart);
         if (r < 0)
@@ -2492,9 +2492,9 @@ static int merge(const Context *c, Hashmap *images) {
 
         assert(c);
 
-        (void) DLOPEN_CRYPTSETUP(LOG_DEBUG, recommended);
-        (void) DLOPEN_LIBBLKID(LOG_DEBUG, required);
-        (void) DLOPEN_LIBMOUNT(LOG_DEBUG, required);
+        (void) dlopen_cryptsetup(LOG_DEBUG);
+        (void) dlopen_libblkid(LOG_DEBUG);
+        (void) dlopen_libmount(LOG_DEBUG);
 
         _cleanup_(pidref_done) PidRef pidref = PIDREF_NULL;
         r = pidref_safe_fork("(sd-merge)", FORK_DEATHSIG_SIGTERM|FORK_LOG|FORK_NEW_MOUNTNS, &pidref);
@@ -3271,7 +3271,10 @@ static int run(int argc, char *argv[]) {
         char **args = NULL;
         int r;
 
+        LIBBLKID_NOTE(required);
         LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(recommended);
+        LIBMOUNT_NOTE(required);
         LIBSELINUX_NOTE(recommended);
 
         log_setup();
diff --git a/src/sysupdate/sysupdate-partition.c b/src/sysupdate/sysupdate-partition.c
index 3fca5cc91e..0b346da62d 100644
--- a/src/sysupdate/sysupdate-partition.c
+++ b/src/sysupdate/sysupdate-partition.c
@@ -161,7 +161,7 @@ int find_suitable_partition(
         POINTER_MAY_BE_NULL(partition_type);
         assert(ret);
 
-        r = DLOPEN_FDISK(LOG_DEBUG, recommended);
+        r = dlopen_fdisk(LOG_DEBUG);
         if (r < 0)
                 return r;
 
@@ -230,7 +230,7 @@ int patch_partition(
         if (change == 0) /* Nothing to do */
                 return 0;
 
-        r = DLOPEN_FDISK(LOG_DEBUG, recommended);
+        r = dlopen_fdisk(LOG_DEBUG);
         if (r < 0)
                 return r;
 
diff --git a/src/sysupdate/sysupdate-resource.c b/src/sysupdate/sysupdate-resource.c
index 08a3f9ef7c..cfc0d09ae6 100644
--- a/src/sysupdate/sysupdate-resource.c
+++ b/src/sysupdate/sysupdate-resource.c
@@ -266,7 +266,7 @@ static int resource_load_from_blockdev(Resource *rr) {
 
         assert(rr);
 
-        r = DLOPEN_FDISK(LOG_DEBUG, recommended);
+        r = dlopen_fdisk(LOG_DEBUG);
         if (r < 0)
                 return r;
 
diff --git a/src/sysupdate/sysupdate.c b/src/sysupdate/sysupdate.c
index 28ea65c033..edf2929235 100644
--- a/src/sysupdate/sysupdate.c
+++ b/src/sysupdate/sysupdate.c
@@ -3568,6 +3568,7 @@ static int run(int argc, char *argv[]) {
         LIBBLKID_NOTE(recommended);
         LIBCRYPTO_NOTE(suggested);
         LIBCRYPTSETUP_NOTE(suggested);
+        LIBFDISK_NOTE(recommended);
         LIBMOUNT_NOTE(recommended);
         LIBSELINUX_NOTE(recommended);
         LIBTSS2_ESYS_NOTE(suggested);
diff --git a/src/tmpfiles/tmpfiles.c b/src/tmpfiles/tmpfiles.c
index 582c6f8a4e..82f6b8da2f 100644
--- a/src/tmpfiles/tmpfiles.c
+++ b/src/tmpfiles/tmpfiles.c
@@ -1271,7 +1271,7 @@ static int parse_acl_cond_exec(
         assert(cond_exec);
         assert(ret);
 
-        r = DLOPEN_LIBACL(LOG_DEBUG, recommended);
+        r = dlopen_libacl(LOG_DEBUG);
         if (r < 0)
                 return r;
 
@@ -1390,7 +1390,7 @@ static int path_set_acl(
 
         assert(c);
 
-        r = DLOPEN_LIBACL(LOG_DEBUG, recommended);
+        r = dlopen_libacl(LOG_DEBUG);
         if (r < 0)
                 return r;
 
@@ -4854,6 +4854,7 @@ static int run(int argc, char *argv[]) {
         } phase;
         int r;
 
+        LIBACL_NOTE(recommended);
         LIBBLKID_NOTE(recommended);
         LIBCRYPTSETUP_NOTE(suggested);
         LIBCRYPTO_NOTE(suggested);
diff --git a/src/tpm2-setup/tpm2-setup.c b/src/tpm2-setup/tpm2-setup.c
index d655ab46d3..3c6cd2aeee 100644
--- a/src/tpm2-setup/tpm2-setup.c
+++ b/src/tpm2-setup/tpm2-setup.c
@@ -601,12 +601,14 @@ static int run(int argc, char *argv[]) {
         }
 
         LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(required);
+        TPM2_NOTE(required);
 
-        r = DLOPEN_LIBCRYPTO(LOG_ERR, required);
+        r = dlopen_libcrypto(LOG_ERR);
         if (r < 0)
                 return r;
 
-        r = DLOPEN_TPM2(LOG_ERR, required);
+        r = dlopen_tpm2(LOG_ERR);
         if (r < 0)
                 return r;
 
diff --git a/src/udev/udev-builtin-blkid.c b/src/udev/udev-builtin-blkid.c
index f9f6890284..a799b5c428 100644
--- a/src/udev/udev-builtin-blkid.c
+++ b/src/udev/udev-builtin-blkid.c
@@ -520,7 +520,7 @@ static int builtin_blkid(UdevEvent *event, int argc, char *argv[]) {
         int64_t offset = 0;
         int r;
 
-        r = DLOPEN_LIBBLKID(LOG_DEBUG, required);
+        r = dlopen_libblkid(LOG_DEBUG);
         if (r < 0)
                 return log_device_debug_errno(dev, r, "blkid not available: %m");
 
diff --git a/src/udev/udevadm.c b/src/udev/udevadm.c
index 62a3cdd64f..ebbbadcea0 100644
--- a/src/udev/udevadm.c
+++ b/src/udev/udevadm.c
@@ -102,7 +102,12 @@ static int run(int argc, char *argv[]) {
         char **args = NULL;
         int r;
 
+        LIBACL_NOTE(recommended);
+        LIBBLKID_NOTE(recommended);
+        LIBKMOD_NOTE(recommended);
+        LIBMOUNT_NOTE(recommended);
         LIBSELINUX_NOTE(recommended);
+        TPM2_NOTE(recommended);
 
         if (invoked_as(argv, "udevd"))
                 return run_udevd(argc, argv);
diff --git a/src/udev/udevd.c b/src/udev/udevd.c
index b452a1e848..593eee89b8 100644
--- a/src/udev/udevd.c
+++ b/src/udev/udevd.c
@@ -58,11 +58,11 @@ int run_udevd(int argc, char *argv[]) {
                 return log_error_errno(r, "Failed to create /run/udev: %m");
 
         /* Load some shared libraries before we fork any workers */
-        (void) DLOPEN_LIBACL(LOG_DEBUG, recommended);
-        (void) DLOPEN_LIBBLKID(LOG_DEBUG, recommended);
-        (void) DLOPEN_LIBKMOD(LOG_DEBUG, recommended);
-        (void) DLOPEN_LIBMOUNT(LOG_DEBUG, recommended);
-        (void) DLOPEN_TPM2(LOG_DEBUG, recommended);
+        (void) dlopen_libacl(LOG_DEBUG);
+        (void) dlopen_libblkid(LOG_DEBUG);
+        (void) dlopen_libkmod(LOG_DEBUG);
+        (void) dlopen_libmount(LOG_DEBUG);
+        (void) dlopen_tpm2(LOG_DEBUG);
 
         if (arg_daemonize) {
                 pid_t pid;
diff --git a/src/validatefs/validatefs.c b/src/validatefs/validatefs.c
index 0f4780ada5..1ac025b74d 100644
--- a/src/validatefs/validatefs.c
+++ b/src/validatefs/validatefs.c
@@ -8,6 +8,7 @@
 #include "build.h"
 #include "chase.h"
 #include "device-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "fd-util.h"
 #include "format-table.h"
@@ -290,7 +291,7 @@ static int validate_gpt_metadata_one(sd_device *d, const char *path, const Valid
         assert(d);
         assert(f);
 
-        r = DLOPEN_LIBBLKID(LOG_ERR, required);
+        r = dlopen_libblkid(LOG_ERR);
         if (r < 0)
                 return r;
 
@@ -400,6 +401,8 @@ static int validate_fields_check(int fd, const char *path, const ValidateFields
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBBLKID_NOTE(required);
+
         log_setup();
 
         r = parse_argv(argc, argv);
diff --git a/src/veritysetup/veritysetup.c b/src/veritysetup/veritysetup.c
index 56c199dbd7..65f0c13c2e 100644
--- a/src/veritysetup/veritysetup.c
+++ b/src/veritysetup/veritysetup.c
@@ -495,8 +495,9 @@ static int run(int argc, char *argv[]) {
         log_setup();
 
         LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(required);
 
-        r = DLOPEN_CRYPTSETUP(LOG_ERR, required);
+        r = dlopen_cryptsetup(LOG_ERR);
         if (r < 0)
                 return r;