diff --git a/src/libsystemd/sd-device/device-private.c b/src/libsystemd/sd-device/device-private.c
index a5638645c6..1c33d13d14 100644
--- a/src/libsystemd/sd-device/device-private.c
+++ b/src/libsystemd/sd-device/device-private.c
@@ -461,8 +461,6 @@ static int device_verify(sd_device *device) {
                                                       "sd-device: Failed to set driver subsystem: %m");
         }
 
-        device->sealed = true;
-
         return 0;
 }
 
@@ -478,6 +476,8 @@ int device_new_from_strv(sd_device **ret, char **strv) {
         if (r < 0)
                 return r;
 
+        device_seal(device);
+
         STRV_FOREACH(key, strv) {
                 r = device_append(device, *key, &major, &minor);
                 if (r < 0)
@@ -512,6 +512,8 @@ int device_new_from_nulstr(sd_device **ret, char *nulstr, size_t len) {
         if (r < 0)
                 return r;
 
+        device_seal(device);
+
         for (size_t i = 0; i < len; ) {
                 char *key;
                 const char *end;
@@ -661,7 +663,7 @@ int device_clone_with_db(sd_device *device, sd_device **ret) {
                 return r;
 
         /* Seal device to prevent reading the uevent file, as the device may have been already removed. */
-        dest->sealed = true;
+        device_seal(dest);
 
         /* Copy syspath, then also devname, sysname or sysnum can be obtained. */
         r = device_set_syspath(dest, device->syspath, false);