There's a few services missing this ordering.
Also remove a duplicate Conflicts=shutdown.target from
systemd-volatile-root.service.
After=system-update.target
DefaultDependencies=no
Conflicts=shutdown.target
+Before=shutdown.target
# system-update-generator uses laccess("/system-update"), while a plain
# ConditionPathExists=/system-update uses access("/system-update"), so
Conflicts=shutdown.target
Requires=systemd-networkd.service
After=systemd-networkd.service
-Before=network-online.target
+Before=network-online.target shutdown.target
[Service]
Type=oneshot
Conflicts=shutdown.target
After=sysroot.mount
Before=initrd-root-fs.target shutdown.target
-Conflicts=shutdown.target
AssertPathExists=/etc/initrd-release
[Service]