From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Mon, 6 Jul 2026 13:08:46 +0000 (+0900)
Subject: tree-wide: embed dlopen notes into individual executables
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4c0d8d967300fde858f83ec4b361db19e3e257c8;p=thirdparty%2Fsystemd.git

tree-wide: embed dlopen notes into individual executables

Previously, when a library was dynamically loaded via a helper function
inside libsystemd-shared.so, the resulting dlopen ELF note was not
propagated to the invoking executable's ELF metadata.

This commit explicitly annotates each executable with the relevant
dlopen ELF notes for any optional dependencies it might potentially
load. This ensures that package managers and build systems can properly
discover runtime dependencies that are triggered indirectly.
---

diff --git a/src/analyze/analyze.c b/src/analyze/analyze.c
index 67a91357675..df41db77ad6 100644
--- a/src/analyze/analyze.c
+++ b/src/analyze/analyze.c
@@ -55,6 +55,7 @@
 #include "bus-util.h"
 #include "calendarspec.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "extract-word.h"
 #include "format-table.h"
 #include "help-util.h"
@@ -685,6 +686,20 @@ static int run(int argc, char *argv[]) {
         _cleanup_strv_free_ char **args = NULL;
         int r;
 
+        LIBACL_NOTE(recommended);
+        LIBAPPARMOR_NOTE(recommended);
+        LIBAUDIT_NOTE(recommended);
+        LIBBLKID_NOTE(recommended);
+        LIBBPF_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(recommended);
+        LIBDW_NOTE(suggested);
+        LIBELF_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBPCRE2_NOTE(suggested);
+        LIBSELINUX_NOTE(recommended);
+        TPM2_NOTE(suggested);
+
         setlocale(LC_ALL, "");
         setlocale(LC_NUMERIC, "C"); /* we want to format/parse floats in C style */
 
diff --git a/src/bless-boot/bless-boot.c b/src/bless-boot/bless-boot.c
index 4242182ac10..6e31ea72f03 100644
--- a/src/bless-boot/bless-boot.c
+++ b/src/bless-boot/bless-boot.c
@@ -5,6 +5,7 @@
 #include "alloc-util.h"
 #include "build.h"
 #include "devnum-util.h"
+#include "dlopen-note.h"
 #include "efivars.h"
 #include "fd-util.h"
 #include "find-esp.h"
@@ -566,6 +567,8 @@ static int run(int argc, char *argv[]) {
         char **args = NULL;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+
         log_setup();
 
         r = parse_argv(argc, argv, &args);
diff --git a/src/bootctl/bootctl.c b/src/bootctl/bootctl.c
index 6e522f01e6a..72d96bc1b0e 100644
--- a/src/bootctl/bootctl.c
+++ b/src/bootctl/bootctl.c
@@ -22,6 +22,7 @@
 #include "crypto-util.h"
 #include "devnum-util.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "efi-loader.h"
 #include "efivars.h"
 #include "escape.h"
@@ -858,6 +859,13 @@ static int run(int argc, char *argv[]) {
         _cleanup_(umount_and_freep) char *mounted_dir = NULL;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBTSS2_ESYS_NOTE(suggested);
+        LIBTSS2_MU_NOTE(suggested);
+        LIBTSS2_RC_NOTE(suggested);
+
         log_setup();
 
         char **args = NULL;
diff --git a/src/core/executor.c b/src/core/executor.c
index e771bdc0243..d0cd16aa9ab 100644
--- a/src/core/executor.c
+++ b/src/core/executor.c
@@ -9,6 +9,7 @@
 #include "build.h"
 #include "capability-util.h"
 #include "cgroup.h"
+#include "dlopen-note.h"
 #include "dynamic-user.h"
 #include "exec-invoke.h"
 #include "execute.h"
@@ -232,6 +233,12 @@ static int run(int argc, char *argv[]) {
 int run_executor(int argc, char *argv[]) {
         int r;
 
+        LIBACL_NOTE(recommended);
+        LIBAPPARMOR_NOTE(recommended);
+        LIBBLKID_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+        TPM2_NOTE(suggested);
+
         /* We use safe_fork() for spawning sd-pam helper process, which internally calls rename_process().
          * As the last step of renaming, all saved argvs are memzero()-ed. Hence, we need to save the argv
          * first to prevent showing "intense" cmdline. See #30352. */
diff --git a/src/core/main.c b/src/core/main.c
index a05715dcfce..84e6c75bef7 100644
--- a/src/core/main.c
+++ b/src/core/main.c
@@ -41,6 +41,7 @@
 #include "dbus.h"
 #include "dbus-manager.h"
 #include "dev-setup.h"
+#include "dlopen-note.h"
 #include "efi-random.h"
 #include "emergency-action.h"
 #include "env-util.h"
@@ -4018,6 +4019,18 @@ finish:
 }
 
 int main(int argc, char *argv[]) {
+        LIBACL_NOTE(recommended);
+        LIBAPPARMOR_NOTE(recommended);
+        LIBAUDIT_NOTE(recommended);
+        LIBBLKID_NOTE(recommended);
+        LIBBPF_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(recommended);
+        LIBKMOD_NOTE(recommended);
+        LIBPCRE2_NOTE(suggested);
+        LIBSECCOMP_NOTE(recommended);
+        TPM2_NOTE(suggested);
+
 #if SYSTEMD_MULTICALL_BINARY
         if (invoked_as(argv, "executor"))
                 return run_executor(argc, argv);
diff --git a/src/coredump/coredump.c b/src/coredump/coredump.c
index 6a758ac2770..649756d3326 100644
--- a/src/coredump/coredump.c
+++ b/src/coredump/coredump.c
@@ -6,6 +6,7 @@
 #include "coredump-kernel-helper.h"
 #include "coredump-receive.h"
 #include "coredump-util.h"
+#include "dlopen-note.h"
 #include "log.h"
 #include "main-func.h"
 #include "string-util.h"
@@ -13,6 +14,12 @@
 static int run(int argc, char *argv[]) {
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBACL_NOTE(recommended);
+        LIBDW_NOTE(suggested);
+        LIBELF_NOTE(suggested);
+        LIBSELINUX_NOTE(recommended);
+
         /* When running as backtrace mode, it is not necessary to use kmsg, not necessary to disable coredump
          * from the command, and unexpectedly passed file descriptors can be silently ignored. */
         if (streq_ptr(argv[1], "--backtrace"))
diff --git a/src/coredump/coredumpctl.c b/src/coredump/coredumpctl.c
index c13cfa1cce1..d69137466bd 100644
--- a/src/coredump/coredumpctl.c
+++ b/src/coredump/coredumpctl.c
@@ -21,6 +21,7 @@
 #include "chase.h"
 #include "compress.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "escape.h"
 #include "extract-word.h"
@@ -1489,6 +1490,13 @@ static int run(int argc, char *argv[]) {
         char **args = NULL;
         int r, units_active;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBACL_NOTE(recommended);
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+
         setlocale(LC_ALL, "");
         log_setup();
 
diff --git a/src/creds/creds.c b/src/creds/creds.c
index 455b157a02c..d559b59e6b2 100644
--- a/src/creds/creds.c
+++ b/src/creds/creds.c
@@ -12,6 +12,7 @@
 #include "bus-util.h"
 #include "creds-util.h"
 #include "dirent-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "escape.h"
 #include "fileio.h"
@@ -1467,6 +1468,9 @@ static int vl_server(void) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBCRYPTO_NOTE(suggested);
+        TPM2_NOTE(suggested);
+
         log_setup();
 
         char **args = NULL;
diff --git a/src/cryptenroll/cryptenroll.c b/src/cryptenroll/cryptenroll.c
index 1b5bbc3016f..ae708146615 100644
--- a/src/cryptenroll/cryptenroll.c
+++ b/src/cryptenroll/cryptenroll.c
@@ -21,6 +21,7 @@
 #include "cryptenroll-varlink.h"
 #include "cryptenroll-wipe.h"
 #include "cryptsetup-util.h"
+#include "dlopen-note.h"
 #include "extract-word.h"
 #include "format-table.h"
 #include "help-util.h"
@@ -1019,6 +1020,13 @@ static int run(int argc, char *argv[]) {
         _cleanup_(enroll_context_done) EnrollContext c = ENROLL_CONTEXT_NULL;
         int slot, r;
 
+        LIBCRYPTO_NOTE(suggested);
+        LIBFIDO2_NOTE(suggested);
+        LIBP11KIT_NOTE(suggested);
+        LIBQRENCODE_NOTE(suggested);
+        PASSWORD_NOTE(suggested);
+        TPM2_NOTE(suggested);
+
         log_setup();
 
         /* A delicious drop of snake oil */
diff --git a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-fido2.c b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-fido2.c
index 800b297ae84..93be8dcb3c8 100644
--- a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-fido2.c
+++ b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-fido2.c
@@ -8,6 +8,7 @@
 #include "alloc-util.h"
 #include "cryptsetup-token.h"
 #include "cryptsetup-token-util.h"
+#include "dlopen-note.h"
 #include "luks2-fido2.h"
 #include "memory-util.h"
 #include "version.h"
@@ -17,7 +18,9 @@
 #define TOKEN_VERSION_MINOR "0"
 
 /* for libcryptsetup debug purpose */
-_public_ const char *cryptsetup_token_version(void) {
+_public_ const char* cryptsetup_token_version(void) {
+        LIBFIDO2_NOTE(suggested);
+
         return TOKEN_VERSION_MAJOR "." TOKEN_VERSION_MINOR " systemd-v" PROJECT_VERSION_FULL " (" GIT_VERSION ")";
 }
 
diff --git a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-pkcs11.c b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-pkcs11.c
index 483686f671e..3c55866fb28 100644
--- a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-pkcs11.c
+++ b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-pkcs11.c
@@ -7,6 +7,7 @@
 #include "alloc-util.h"
 #include "cryptsetup-token.h"
 #include "cryptsetup-token-util.h"
+#include "dlopen-note.h"
 #include "luks2-pkcs11.h"
 #include "memory-util.h"
 #include "pkcs11-util.h"
@@ -17,7 +18,10 @@
 #define TOKEN_VERSION_MINOR "0"
 
 /* for libcryptsetup debug purpose */
-_public_ const char *cryptsetup_token_version(void) {
+_public_ const char* cryptsetup_token_version(void) {
+        LIBCRYPTO_NOTE(suggested);
+        LIBP11KIT_NOTE(suggested);
+
         return TOKEN_VERSION_MAJOR "." TOKEN_VERSION_MINOR " systemd-v" PROJECT_VERSION_FULL " (" GIT_VERSION ")";
 }
 
diff --git a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-tpm2.c b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-tpm2.c
index dd1cb77d8c3..dc67ebeb7aa 100644
--- a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-tpm2.c
+++ b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-tpm2.c
@@ -5,6 +5,7 @@
 #include "alloc-util.h"
 #include "cryptsetup-token.h"
 #include "cryptsetup-token-util.h"
+#include "dlopen-note.h"
 #include "hexdecoct.h"
 #include "json-util.h"
 #include "luks2-tpm2.h"
@@ -18,7 +19,9 @@
 #define TOKEN_VERSION_MINOR "0"
 
 /* for libcryptsetup debug purpose */
-_public_ const char *cryptsetup_token_version(void) {
+_public_ const char* cryptsetup_token_version(void) {
+        LIBCRYPTO_NOTE(suggested);
+        TPM2_NOTE(suggested);
 
         return TOKEN_VERSION_MAJOR "." TOKEN_VERSION_MINOR " systemd-v" PROJECT_VERSION_FULL " (" GIT_VERSION ")";
 }
diff --git a/src/cryptsetup/cryptsetup.c b/src/cryptsetup/cryptsetup.c
index 9be25d004d7..db34b7e9747 100644
--- a/src/cryptsetup/cryptsetup.c
+++ b/src/cryptsetup/cryptsetup.c
@@ -18,6 +18,7 @@
 #include "cryptsetup-pkcs11.h"
 #include "cryptsetup-tpm2.h"
 #include "cryptsetup-util.h"
+#include "dlopen-note.h"
 #include "efi-api.h"
 #include "efi-loader.h"
 #include "efivars.h"
@@ -2884,6 +2885,12 @@ static int verb_detach(int argc, char *argv[], uintptr_t _data, void *userdata)
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBFIDO2_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBP11KIT_NOTE(suggested);
+        TPM2_NOTE(suggested);
+
         log_setup();
 
         umask(0022);
diff --git a/src/debug-generator/debug-generator.c b/src/debug-generator/debug-generator.c
index 700ad528930..c0c799b06f3 100644
--- a/src/debug-generator/debug-generator.c
+++ b/src/debug-generator/debug-generator.c
@@ -5,6 +5,7 @@
 #include "alloc-util.h"
 #include "bitfield.h"
 #include "creds-util.h"
+#include "dlopen-note.h"
 #include "dropin.h"
 #include "errno-util.h"
 #include "extract-word.h"
@@ -364,6 +365,9 @@ static int run(const char *dest, const char *dest_early, const char *dest_late)
         const char *credentials_dir;
         int r;
 
+        LIBCRYPTO_NOTE(suggested);
+        TPM2_NOTE(suggested);
+
         assert_se(arg_dest = dest_early);
 
         r = proc_cmdline_parse(parse_proc_cmdline_item, NULL, PROC_CMDLINE_RD_STRICT | PROC_CMDLINE_STRIP_RD_PREFIX);
diff --git a/src/dissect/dissect.c b/src/dissect/dissect.c
index e3db8470b65..352d7ffa919 100644
--- a/src/dissect/dissect.c
+++ b/src/dissect/dissect.c
@@ -19,6 +19,7 @@
 #include "device-util.h"
 #include "discover-image.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "errno-util.h"
 #include "escape.h"
@@ -1968,6 +1969,13 @@ static int run(int argc, char *argv[]) {
         _cleanup_close_ int userns_fd = -EBADF;
         int r;
 
+        LIBACL_NOTE(recommended);
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         if (invoked_as(argv, "mount.ddi"))
diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
index e81923beb5b..55b4f922c1b 100644
--- a/src/firstboot/firstboot.c
+++ b/src/firstboot/firstboot.c
@@ -20,6 +20,7 @@
 #include "copy.h"
 #include "creds-util.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "env-file.h"
 #include "errno-util.h"
 #include "fd-util.h"
@@ -1702,6 +1703,14 @@ static int run(int argc, char *argv[]) {
         _cleanup_close_ int rfd = -EBADF;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPT_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+        PASSWORD_NOTE(suggested);
+
         r = parse_argv(argc, argv);
         if (r <= 0)
                 return r;
diff --git a/src/fstab-generator/fstab-generator.c b/src/fstab-generator/fstab-generator.c
index 3a5ce47691e..b723868f519 100644
--- a/src/fstab-generator/fstab-generator.c
+++ b/src/fstab-generator/fstab-generator.c
@@ -14,6 +14,7 @@
 #include "bus-util.h"
 #include "chase.h"
 #include "creds-util.h"
+#include "dlopen-note.h"
 #include "efi-loader.h"
 #include "env-util.h"
 #include "errno-util.h"
@@ -1729,6 +1730,11 @@ static int run_generator(void) {
 }
 
 static int run(int argc, char **argv) {
+        LIBCRYPTO_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+        TPM2_NOTE(suggested);
+
         arg_sysroot_check = invoked_as(argv, "systemd-sysroot-fstab-check");
 
         if (arg_sysroot_check) {
diff --git a/src/getty-generator/getty-generator.c b/src/getty-generator/getty-generator.c
index 69ef0aae04c..62e0735dd7b 100644
--- a/src/getty-generator/getty-generator.c
+++ b/src/getty-generator/getty-generator.c
@@ -5,6 +5,7 @@
 
 #include "alloc-util.h"
 #include "creds-util.h"
+#include "dlopen-note.h"
 #include "extract-word.h"
 #include "fd-util.h"
 #include "fileio.h"
@@ -277,6 +278,9 @@ static int run(const char *dest, const char *dest_early, const char *dest_late)
 
         assert_se(arg_dest = dest);
 
+        LIBCRYPTO_NOTE(suggested);
+        TPM2_NOTE(suggested);
+
         if (in_initrd()) {
                 log_debug("Skipping generator, running in the initrd.");
                 return EXIT_SUCCESS;
diff --git a/src/gpt-auto-generator/gpt-auto-generator.c b/src/gpt-auto-generator/gpt-auto-generator.c
index b92ac8f66a7..5305957bd93 100644
--- a/src/gpt-auto-generator/gpt-auto-generator.c
+++ b/src/gpt-auto-generator/gpt-auto-generator.c
@@ -9,6 +9,7 @@
 #include "device-util.h"
 #include "devnum-util.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "dropin.h"
 #include "efi-loader.h"
 #include "efivars.h"
@@ -1359,6 +1360,10 @@ static int parse_proc_cmdline_item(const char *key, const char *value, void *dat
 static int run(const char *dest, const char *dest_early, const char *dest_late) {
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         assert_se(arg_dest = dest);
         assert_se(arg_dest_late = dest_late);
 
diff --git a/src/growfs/growfs.c b/src/growfs/growfs.c
index f54266a1102..e9b34529b52 100644
--- a/src/growfs/growfs.c
+++ b/src/growfs/growfs.c
@@ -11,6 +11,7 @@
 #include "device-util.h"
 #include "devnum-util.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "fd-util.h"
 #include "format-table.h"
 #include "format-util.h"
@@ -192,6 +193,8 @@ static int run(int argc, char *argv[]) {
         dev_t devno;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+
         log_setup();
 
         r = parse_argv(argc, argv);
diff --git a/src/growfs/makefs.c b/src/growfs/makefs.c
index 3747bc0ee28..26d3f5a4bfd 100644
--- a/src/growfs/makefs.c
+++ b/src/growfs/makefs.c
@@ -7,6 +7,7 @@
 #include "alloc-util.h"
 #include "blockdev-util.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "fd-util.h"
 #include "log.h"
 #include "main-func.h"
@@ -20,6 +21,9 @@ static int run(int argc, char *argv[]) {
         struct stat st;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBMOUNT_NOTE(recommended);
+
         log_setup();
 
         if (argc != 3)
diff --git a/src/home/homectl.c b/src/home/homectl.c
index 84e3ea12053..f4be3c0e702 100644
--- a/src/home/homectl.c
+++ b/src/home/homectl.c
@@ -19,6 +19,7 @@
 #include "creds-util.h"
 #include "crypto-util.h"
 #include "dirent-util.h"
+#include "dlopen-note.h"
 #include "dns-domain.h"
 #include "env-util.h"
 #include "errno-util.h"
@@ -5183,6 +5184,12 @@ static int run(int argc, char *argv[]) {
         char **args = NULL;
         int r;
 
+        LIBCRYPT_NOTE(recommended);
+        LIBFIDO2_NOTE(suggested);
+        LIBP11KIT_NOTE(suggested);
+        LIBQRENCODE_NOTE(suggested);
+        PASSWORD_NOTE(suggested);
+
         log_setup();
 
         r = redirect_bus_mgr();
diff --git a/src/home/homed.c b/src/home/homed.c
index 753aa95eb3f..fc573c5f786 100644
--- a/src/home/homed.c
+++ b/src/home/homed.c
@@ -7,6 +7,7 @@
 #include "bus-log-control-api.h"
 #include "bus-object.h"
 #include "daemon-util.h"
+#include "dlopen-note.h"
 #include "homed-manager.h"
 #include "homed-manager-bus.h"
 #include "log.h"
@@ -18,6 +19,9 @@ static int run(int argc, char *argv[]) {
         _unused_ _cleanup_(notify_on_cleanup) const char *notify_stop = NULL;
         int r;
 
+        LIBCRYPT_NOTE(recommended);
+        PASSWORD_NOTE(suggested);
+
         log_setup();
 
         r = service_parse_argv("systemd-homed.service",
diff --git a/src/home/homework.c b/src/home/homework.c
index 81775e88726..7e48f012069 100644
--- a/src/home/homework.c
+++ b/src/home/homework.c
@@ -13,6 +13,7 @@
 #include "chown-recursive.h"
 #include "copy.h"
 #include "cryptsetup-util.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "errno-util.h"
 #include "fd-util.h"
@@ -1998,6 +1999,12 @@ static int run(int argc, char *argv[]) {
         sd_json_variant *fdmap, *blob_fd_variant;
         int r;
 
+        LIBCRYPT_NOTE(recommended);
+        LIBFIDO2_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBP11KIT_NOTE(suggested);
+        LIBSELINUX_NOTE(recommended);
+
         start = now(CLOCK_MONOTONIC);
 
         log_setup();
diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
index 99de3f23f6f..98ade098a7e 100644
--- a/src/hostname/hostnamed.c
+++ b/src/hostname/hostnamed.c
@@ -22,6 +22,7 @@
 #include "daemon-util.h"
 #include "device-private.h"
 #include "device-util.h"
+#include "dlopen-note.h"
 #include "env-file.h"
 #include "env-util.h"
 #include "extract-word.h"
@@ -2659,6 +2660,8 @@ static int run(int argc, char *argv[]) {
         };
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         r = service_parse_argv("systemd-hostnamed.service",
diff --git a/src/hwdb/hwdb.c b/src/hwdb/hwdb.c
index 4d2d6fe8c48..c172153bc2a 100644
--- a/src/hwdb/hwdb.c
+++ b/src/hwdb/hwdb.c
@@ -2,6 +2,7 @@
 
 #include "alloc-util.h"
 #include "build.h"
+#include "dlopen-note.h"
 #include "format-table.h"
 #include "hwdb-util.h"
 #include "label-util.h"
@@ -114,6 +115,8 @@ static int parse_argv(int argc, char *argv[], char ***ret_args) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         char **args = NULL;
diff --git a/src/import/export.c b/src/import/export.c
index 0b6d27b9ffa..2e1576c467d 100644
--- a/src/import/export.c
+++ b/src/import/export.c
@@ -9,6 +9,7 @@
 #include "ansi-color.h"
 #include "build.h"
 #include "discover-image.h"
+#include "dlopen-note.h"
 #include "export-raw.h"
 #include "export-tar.h"
 #include "fd-util.h"
@@ -282,6 +283,9 @@ static int parse_argv(int argc, char *argv[], char ***ret_args) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        ARCHIVE_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         setlocale(LC_ALL, "");
         log_setup();
 
diff --git a/src/import/import-fs.c b/src/import/import-fs.c
index dcb0f8c511a..fd54faefc02 100644
--- a/src/import/import-fs.c
+++ b/src/import/import-fs.c
@@ -9,6 +9,7 @@
 #include "build.h"
 #include "copy.h"
 #include "discover-image.h"
+#include "dlopen-note.h"
 #include "fd-util.h"
 #include "format-table.h"
 #include "format-util.h"
@@ -392,6 +393,8 @@ static int parse_argv(int argc, char *argv[], char ***ret_args) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         setlocale(LC_ALL, "");
         log_setup();
 
diff --git a/src/import/import-generator.c b/src/import/import-generator.c
index f176492a54c..46b605b995d 100644
--- a/src/import/import-generator.c
+++ b/src/import/import-generator.c
@@ -5,6 +5,7 @@
 #include "alloc-util.h"
 #include "creds-util.h"
 #include "discover-image.h"
+#include "dlopen-note.h"
 #include "efivars.h"
 #include "errno-util.h"
 #include "extract-word.h"
@@ -426,6 +427,9 @@ static int generate(void) {
 static int run(const char *dest, const char *dest_early, const char *dest_late) {
         int r;
 
+        LIBCRYPTO_NOTE(suggested);
+        TPM2_NOTE(suggested);
+
         assert_se(arg_dest = dest);
 
         r = proc_cmdline_parse(parse_proc_cmdline_item, NULL, PROC_CMDLINE_RD_STRICT|PROC_CMDLINE_STRIP_RD_PREFIX);
diff --git a/src/import/import.c b/src/import/import.c
index 18276fa72d2..782557a2211 100644
--- a/src/import/import.c
+++ b/src/import/import.c
@@ -9,6 +9,7 @@
 #include "ansi-color.h"
 #include "build.h"
 #include "discover-image.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "fd-util.h"
 #include "format-table.h"
@@ -469,6 +470,9 @@ static void parse_env(void) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        ARCHIVE_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         setlocale(LC_ALL, "");
         log_setup();
 
diff --git a/src/import/importd.c b/src/import/importd.c
index c329491386c..5220b3ba03f 100644
--- a/src/import/importd.c
+++ b/src/import/importd.c
@@ -19,6 +19,7 @@
 #include "constants.h"
 #include "daemon-util.h"
 #include "discover-image.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "event-util.h"
 #include "fd-util.h"
@@ -2081,6 +2082,8 @@ static int run(int argc, char *argv[]) {
         RuntimeScope scope = RUNTIME_SCOPE_SYSTEM;
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         r = service_parse_argv("systemd-importd.service",
diff --git a/src/import/pull.c b/src/import/pull.c
index 09294bc6fc5..7fe3a7e4dd6 100644
--- a/src/import/pull.c
+++ b/src/import/pull.c
@@ -9,6 +9,7 @@
 #include "ansi-color.h"
 #include "build.h"
 #include "discover-image.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "format-table.h"
 #include "hexdecoct.h"
@@ -608,6 +609,10 @@ static void parse_env(void) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        ARCHIVE_NOTE(recommended);
+        LIBCURL_NOTE(suggested);
+        LIBSELINUX_NOTE(recommended);
+
         setlocale(LC_ALL, "");
         log_setup();
 
diff --git a/src/journal-remote/journal-gatewayd.c b/src/journal-remote/journal-gatewayd.c
index a6ef7c77fa0..9def4a3bc9f 100644
--- a/src/journal-remote/journal-gatewayd.c
+++ b/src/journal-remote/journal-gatewayd.c
@@ -1259,6 +1259,9 @@ static int run(int argc, char *argv[]) {
                 MHD_USE_THREAD_PER_CONNECTION;
         int r, n;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBGNUTLS_NOTE(suggested);
+
         log_setup();
 
         r = parse_argv(argc, argv);
diff --git a/src/journal-remote/journal-remote-main.c b/src/journal-remote/journal-remote-main.c
index ff283a2ea56..504471fc8af 100644
--- a/src/journal-remote/journal-remote-main.c
+++ b/src/journal-remote/journal-remote-main.c
@@ -9,6 +9,7 @@
 #include "build.h"
 #include "conf-parser.h"
 #include "daemon-util.h"
+#include "dlopen-note.h"
 #include "extract-word.h"
 #include "fd-util.h"
 #include "format-table.h"
@@ -1165,6 +1166,11 @@ static int run(int argc, char **argv) {
         _cleanup_free_ char *cert = NULL, *trust = NULL;
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBCRYPTO_NOTE(suggested);
+        LIBGNUTLS_NOTE(suggested);
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         journal_auth_init();
diff --git a/src/journal-remote/journal-upload.c b/src/journal-remote/journal-upload.c
index a24f577c892..48a8df559ef 100644
--- a/src/journal-remote/journal-upload.c
+++ b/src/journal-remote/journal-upload.c
@@ -12,6 +12,7 @@
 #include "conf-parser.h"
 #include "curl-util.h"
 #include "daemon-util.h"
+#include "dlopen-note.h"
 #include "env-file.h"
 #include "extract-word.h"
 #include "fd-util.h"
@@ -869,6 +870,8 @@ static int run(int argc, char **argv) {
         bool use_journal;
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+
         log_setup();
 
         r = parse_config();
diff --git a/src/journal/bsod.c b/src/journal/bsod.c
index e380e08b1c2..9a9067088c0 100644
--- a/src/journal/bsod.c
+++ b/src/journal/bsod.c
@@ -8,6 +8,7 @@
 
 #include "alloc-util.h"
 #include "build.h"
+#include "dlopen-note.h"
 #include "fd-util.h"
 #include "fileio.h"
 #include "format-table.h"
@@ -287,6 +288,9 @@ static int run(int argc, char *argv[]) {
         _cleanup_free_ char *message = NULL;
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBQRENCODE_NOTE(suggested);
+
         log_setup();
 
         r = parse_argv(argc, argv);
diff --git a/src/journal/journalctl.c b/src/journal/journalctl.c
index 71f4f717f42..bb5b376a933 100644
--- a/src/journal/journalctl.c
+++ b/src/journal/journalctl.c
@@ -7,6 +7,7 @@
 
 #include "build.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "extract-word.h"
 #include "format-table.h"
 #include "glob-util.h"
@@ -1021,6 +1022,14 @@ static int run(int argc, char *argv[]) {
         _cleanup_strv_free_ char **args = NULL;
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBACL_NOTE(recommended);
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBPCRE2_NOTE(suggested);
+        LIBQRENCODE_NOTE(suggested);
+
         setlocale(LC_ALL, "");
         log_setup();
 
diff --git a/src/journal/journald.c b/src/journal/journald.c
index 91f02178f50..3cab48f6b7b 100644
--- a/src/journal/journald.c
+++ b/src/journal/journald.c
@@ -6,6 +6,7 @@
 #include "sd-event.h"
 #include "sd-messages.h"
 
+#include "dlopen-note.h"
 #include "format-util.h"
 #include "journal-authenticate.h"
 #include "journald-kmsg.h"
@@ -25,6 +26,12 @@ static int run(int argc, char *argv[]) {
         LogTarget log_target;
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBACL_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBPCRE2_NOTE(suggested);
+        LIBSELINUX_NOTE(recommended);
+
         if (argc > 2)
                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "This program takes one or no arguments.");
 
diff --git a/src/kernel-install/kernel-install.c b/src/kernel-install/kernel-install.c
index 132ae803dfd..69fdbcfc34a 100644
--- a/src/kernel-install/kernel-install.c
+++ b/src/kernel-install/kernel-install.c
@@ -12,6 +12,7 @@
 #include "chase.h"
 #include "conf-files.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "env-file.h"
 #include "env-util.h"
 #include "exec-util.h"
@@ -1664,6 +1665,11 @@ static int parse_argv(int argc, char *argv[], char ***remaining_args) {
 static int run(int argc, char* argv[]) {
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+
         log_setup();
 
         char **args = NULL;
diff --git a/src/locale/localed.c b/src/locale/localed.c
index 4296db6f2f9..a6ff82ffbc7 100644
--- a/src/locale/localed.c
+++ b/src/locale/localed.c
@@ -15,6 +15,7 @@
 #include "bus-util.h"
 #include "constants.h"
 #include "daemon-util.h"
+#include "dlopen-note.h"
 #include "hashmap.h"
 #include "label-util.h"
 #include "localed-util.h"
@@ -632,6 +633,8 @@ static int run(int argc, char *argv[]) {
         _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         r = service_parse_argv("systemd-localed.service",
diff --git a/src/login/loginctl.c b/src/login/loginctl.c
index 19ee4c5b75b..be670254211 100644
--- a/src/login/loginctl.c
+++ b/src/login/loginctl.c
@@ -17,6 +17,7 @@
 #include "bus-util.h"
 #include "cgroup-show.h"
 #include "cgroup-util.h"
+#include "dlopen-note.h"
 #include "format-table.h"
 #include "format-util.h"
 #include "help-util.h"
@@ -1661,6 +1662,8 @@ static int run(int argc, char *argv[]) {
         char **args = NULL;
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+
         setlocale(LC_ALL, "");
         log_setup();
 
diff --git a/src/login/logind.c b/src/login/logind.c
index fb8e841b9d4..9fcf57ab916 100644
--- a/src/login/logind.c
+++ b/src/login/logind.c
@@ -17,6 +17,7 @@
 #include "device-util.h"
 #include "devnum-util.h"
 #include "dirent-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "escape.h"
 #include "fd-util.h"
@@ -1351,6 +1352,10 @@ static int run(int argc, char *argv[]) {
         _unused_ _cleanup_(notify_on_cleanup) const char *notify_message = NULL;
         int r;
 
+        LIBACL_NOTE(recommended);
+        LIBBLKID_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         log_set_facility(LOG_AUTH);
         log_setup();
 
diff --git a/src/login/user-runtime-dir.c b/src/login/user-runtime-dir.c
index bc522bcbca2..728b15f4d3f 100644
--- a/src/login/user-runtime-dir.c
+++ b/src/login/user-runtime-dir.c
@@ -8,6 +8,7 @@
 #include "bus-error.h"
 #include "bus-locator.h"
 #include "devnum-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "fd-util.h"
 #include "format-util.h"
@@ -327,6 +328,9 @@ static int do_tmpfs_quota(UserRecord *ur) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         if (argc != 3)
diff --git a/src/machine-id-setup/machine-id-setup-main.c b/src/machine-id-setup/machine-id-setup-main.c
index 2363427b5f5..1eb372be649 100644
--- a/src/machine-id-setup/machine-id-setup-main.c
+++ b/src/machine-id-setup/machine-id-setup-main.c
@@ -5,6 +5,7 @@
 #include "alloc-util.h"
 #include "build.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "format-table.h"
 #include "id128-util.h"
 #include "image-policy.h"
@@ -131,6 +132,12 @@ static int run(int argc, char *argv[]) {
         _cleanup_(umount_and_freep) char *mounted_dir = NULL;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        TPM2_NOTE(suggested);
+
         log_setup();
 
         r = parse_argv(argc, argv);
diff --git a/src/machine/machinectl.c b/src/machine/machinectl.c
index b0efb6ec029..dc2381fc84a 100644
--- a/src/machine/machinectl.c
+++ b/src/machine/machinectl.c
@@ -26,6 +26,7 @@
 #include "bus-wait-for-jobs.h"
 #include "cgroup-show.h"
 #include "cgroup-util.h"
+#include "dlopen-note.h"
 #include "edit-util.h"
 #include "env-util.h"
 #include "fd-util.h"
@@ -2634,6 +2635,9 @@ static int run(int argc, char *argv[]) {
         _cleanup_strv_free_ char **args = NULL;
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBSELINUX_NOTE(recommended);
+
         setlocale(LC_ALL, "");
         log_setup();
 
diff --git a/src/machine/machined.c b/src/machine/machined.c
index 954e2606921..47b7650caf8 100644
--- a/src/machine/machined.c
+++ b/src/machine/machined.c
@@ -16,6 +16,7 @@
 #include "constants.h"
 #include "daemon-util.h"
 #include "dirent-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "fd-util.h"
 #include "hash-funcs.h"
@@ -347,6 +348,12 @@ static int run(int argc, char *argv[]) {
         RuntimeScope scope = RUNTIME_SCOPE_SYSTEM;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         log_set_facility(LOG_AUTH);
         log_setup();
 
diff --git a/src/measure/measure-tool.c b/src/measure/measure-tool.c
index 893fd4e593a..b224f95b35e 100644
--- a/src/measure/measure-tool.c
+++ b/src/measure/measure-tool.c
@@ -8,6 +8,7 @@
 #include "ask-password-api.h"
 #include "build.h"
 #include "crypto-util.h"
+#include "dlopen-note.h"
 #include "efi-loader.h"
 #include "efivars.h"
 #include "fd-util.h"
@@ -1130,6 +1131,8 @@ static int verb_policy_digest(int argc, char *argv[], uintptr_t _data, void *use
 static int run(int argc, char *argv[]) {
         int r;
 
+        TPM2_NOTE(suggested);
+
         log_setup();
 
         char **args = NULL;
diff --git a/src/modules-load/modules-load.c b/src/modules-load/modules-load.c
index eb58b70c7b0..85452f62a54 100644
--- a/src/modules-load/modules-load.c
+++ b/src/modules-load/modules-load.c
@@ -12,6 +12,7 @@
 #include "conf-files.h"
 #include "constants.h"
 #include "cpu-set-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "fd-util.h"
 #include "fileio.h"
@@ -390,6 +391,8 @@ static int run(int argc, char *argv[]) {
         char *module;
         int ret = 0, r;
 
+        LIBKMOD_NOTE(required);
+
         char **args = NULL;
         r = parse_argv(argc, argv, &args);
         if (r <= 0)
diff --git a/src/mount/mount-tool.c b/src/mount/mount-tool.c
index c35769e56a7..58b689190d7 100644
--- a/src/mount/mount-tool.c
+++ b/src/mount/mount-tool.c
@@ -14,6 +14,7 @@
 #include "chase.h"
 #include "device-private.h"
 #include "device-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "escape.h"
 #include "fd-util.h"
@@ -1479,6 +1480,8 @@ static int run(int argc, char* argv[]) {
         char **args = NULL;
         int r;
 
+        LIBMOUNT_NOTE(recommended);
+
         log_setup();
 
         r = parse_argv(argc, argv, &args);
diff --git a/src/mountfsd/mountwork.c b/src/mountfsd/mountwork.c
index 4cd4e4abdd2..af84ace1eb9 100644
--- a/src/mountfsd/mountwork.c
+++ b/src/mountfsd/mountwork.c
@@ -15,6 +15,7 @@
 #include "chase.h"
 #include "discover-image.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "errno-util.h"
 #include "escape.h"
@@ -1489,6 +1490,11 @@ static int run(int argc, char *argv[]) {
         unsigned n_iterations = 0;
         int m, listen_fd, r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+
         log_setup();
 
         m = sd_listen_fds(false);
diff --git a/src/mstack/mstack-tool.c b/src/mstack/mstack-tool.c
index 244e7dc682d..45c699d5742 100644
--- a/src/mstack/mstack-tool.c
+++ b/src/mstack/mstack-tool.c
@@ -6,6 +6,7 @@
 #include "argv-util.h"
 #include "build.h"
 #include "chase.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "extract-word.h"
 #include "fd-util.h"
@@ -376,6 +377,11 @@ static int umount_mstack(void) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+
         log_setup();
 
         if (invoked_as(argv, "mount.mstack"))
diff --git a/src/network/generator/network-generator-main.c b/src/network/generator/network-generator-main.c
index df9ce9265db..ae15dff2b10 100644
--- a/src/network/generator/network-generator-main.c
+++ b/src/network/generator/network-generator-main.c
@@ -5,6 +5,7 @@
 #include "alloc-util.h"
 #include "build.h"
 #include "creds-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "fd-util.h"
 #include "format-table.h"
@@ -197,6 +198,8 @@ static int run(int argc, char *argv[]) {
         _cleanup_(context_clear) Context context = {};
         int r, ret = 0;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         umask(0022);
diff --git a/src/network/networkctl.c b/src/network/networkctl.c
index bf74f10a4a4..f85c74b6afa 100644
--- a/src/network/networkctl.c
+++ b/src/network/networkctl.c
@@ -4,6 +4,7 @@
 
 #include "alloc-util.h"
 #include "build.h"
+#include "dlopen-note.h"
 #include "format-table.h"
 #include "help-util.h"
 #include "log.h"
@@ -208,6 +209,9 @@ static int run(int argc, char* argv[]) {
         char **args = NULL;
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         r = parse_argv(argc, argv, &args);
diff --git a/src/network/networkd.c b/src/network/networkd.c
index 230339ba0c7..9415c090257 100644
--- a/src/network/networkd.c
+++ b/src/network/networkd.c
@@ -9,6 +9,7 @@
 #include "bus-object.h"
 #include "capability-util.h"
 #include "daemon-util.h"
+#include "dlopen-note.h"
 #include "main-func.h"
 #include "mkdir.h"
 #include "networkd-conf.h"
@@ -24,6 +25,15 @@ static int run(int argc, char *argv[]) {
         _unused_ _cleanup_(notify_on_cleanup) const char *notify_message = NULL;
         int r;
 
+        LIBAPPARMOR_NOTE(recommended);
+        LIBAUDIT_NOTE(recommended);
+        LIBIDN2_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+        LIBTSS2_ESYS_NOTE(suggested);
+        LIBTSS2_MU_NOTE(suggested);
+        LIBTSS2_RC_NOTE(suggested);
+
         log_setup();
 
         r = service_parse_argv("systemd-networkd.service",
diff --git a/src/nspawn/meson.build b/src/nspawn/meson.build
index ddf859c63d5..366cec23f61 100644
--- a/src/nspawn/meson.build
+++ b/src/nspawn/meson.build
@@ -47,7 +47,11 @@ executables += [
                         executable_template['include_directories'],
                 ],
                 'dependencies' : [
+                        libacl_cflags,
+                        libblkid_cflags,
+                        libcryptsetup_cflags,
                         libmount_cflags,
+                        libopenssl_cflags,
                         libseccomp_cflags,
                         libselinux_cflags,
                 ],
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index c4dfc9584ec..f4d85c0418d 100644
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -20,9 +20,11 @@
 #include "sd-path.h"
 #include "sd-varlink.h"
 
+#include "acl-util.h"
 #include "alloc-util.h"
 #include "barrier.h"
 #include "base-filesystem.h"
+#include "blkid-util.h"
 #include "btrfs-util.h"
 #include "build.h"
 #include "bus-error.h"
@@ -36,12 +38,13 @@
 #include "constants.h"
 #include "copy.h"
 #include "cpu-set-util.h"
+#include "crypto-util.h"
+#include "cryptsetup-util.h"
 #include "daemon-util.h"
 #include "dev-setup.h"
 #include "devnum-util.h"
 #include "discover-image.h"
 #include "dissect-image.h"
-#include "dlfcn-util.h"
 #include "env-util.h"
 #include "escape.h"
 #include "ether-addr-util.h"
@@ -6141,6 +6144,10 @@ static int run(int argc, char *argv[]) {
         if (arg_cleanup)
                 return do_cleanup();
 
+        (void) DLOPEN_CRYPTSETUP(LOG_DEBUG, suggested);
+        (void) DLOPEN_LIBACL(LOG_DEBUG, recommended);
+        (void) DLOPEN_LIBBLKID(LOG_DEBUG, recommended);
+        (void) DLOPEN_LIBCRYPTO(LOG_WARNING, recommended);
         (void) DLOPEN_LIBMOUNT(LOG_DEBUG, recommended);
         (void) DLOPEN_LIBSECCOMP(LOG_DEBUG, recommended);
         (void) DLOPEN_LIBSELINUX(LOG_DEBUG, recommended);
diff --git a/src/pcrextend/pcrextend.c b/src/pcrextend/pcrextend.c
index ab212600dfd..693435f3a4e 100644
--- a/src/pcrextend/pcrextend.c
+++ b/src/pcrextend/pcrextend.c
@@ -7,6 +7,7 @@
 #include "alloc-util.h"
 #include "build.h"
 #include "crypto-util.h"
+#include "dlopen-note.h"
 #include "efi-loader.h"
 #include "escape.h"
 #include "format-table.h"
@@ -512,6 +513,9 @@ static int run(int argc, char *argv[]) {
         Tpm2UserspaceEventType event = _TPM2_USERSPACE_EVENT_TYPE_INVALID;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        TPM2_NOTE(suggested);
+
         log_setup();
 
         char **args = NULL;
diff --git a/src/pcrlock/pcrlock.c b/src/pcrlock/pcrlock.c
index d51215d522a..2d084d8eb18 100644
--- a/src/pcrlock/pcrlock.c
+++ b/src/pcrlock/pcrlock.c
@@ -21,6 +21,7 @@
 #include "copy.h"
 #include "creds-util.h"
 #include "crypto-util.h"
+#include "dlopen-note.h"
 #include "efi-api.h"
 #include "efivars.h"
 #include "env-util.h"
@@ -5698,6 +5699,10 @@ static int vl_method_on_completed_update(sd_varlink *link, sd_json_variant *para
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+        TPM2_NOTE(suggested);
+
         log_setup();
 
         r = mac_init();
diff --git a/src/portable/portabled.c b/src/portable/portabled.c
index 23982c6edef..2a8bdc36c78 100644
--- a/src/portable/portabled.c
+++ b/src/portable/portabled.c
@@ -12,6 +12,7 @@
 #include "common-signal.h"
 #include "constants.h"
 #include "daemon-util.h"
+#include "dlopen-note.h"
 #include "hashmap.h"
 #include "log.h"
 #include "main-func.h"
@@ -143,6 +144,10 @@ static int run(int argc, char *argv[]) {
         RuntimeScope scope = RUNTIME_SCOPE_SYSTEM;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         r = service_parse_argv("systemd-portabled.service",
diff --git a/src/pstore/pstore.c b/src/pstore/pstore.c
index 3e84b25bfb4..35e03a814d1 100644
--- a/src/pstore/pstore.c
+++ b/src/pstore/pstore.c
@@ -13,6 +13,7 @@
 #include "conf-parser.h"
 #include "copy.h"
 #include "dirent-util.h"
+#include "dlopen-note.h"
 #include "fd-util.h"
 #include "fileio.h"
 #include "iovec-util.h"
@@ -309,6 +310,8 @@ static int run(int argc, char *argv[]) {
         _cleanup_(pstore_entries_reset) PStoreList list = {};
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         if (argc == 3) {
diff --git a/src/remount-fs/remount-fs.c b/src/remount-fs/remount-fs.c
index 698bb80a4fc..1d5457728fe 100644
--- a/src/remount-fs/remount-fs.c
+++ b/src/remount-fs/remount-fs.c
@@ -5,6 +5,7 @@
 #include <unistd.h>
 
 #include "alloc-util.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "exit-status.h"
 #include "format-util.h"
@@ -122,6 +123,8 @@ static int run(int argc, char *argv[]) {
         _cleanup_hashmap_free_ Hashmap *pids = NULL;
         int r;
 
+        LIBMOUNT_NOTE(recommended);
+
         log_setup();
 
         if (argc > 1)
diff --git a/src/repart/repart.c b/src/repart/repart.c
index 099b901226d..3eada3bc42a 100644
--- a/src/repart/repart.c
+++ b/src/repart/repart.c
@@ -11614,6 +11614,9 @@ static int run(int argc, char *argv[]) {
         bool node_is_our_loop = false;
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+        TPM2_NOTE(suggested);
+
         log_setup();
 
         r = parse_argv(argc, argv);
diff --git a/src/resolve/resolvectl.c b/src/resolve/resolvectl.c
index 011162865b8..ea6ee54ba62 100644
--- a/src/resolve/resolvectl.c
+++ b/src/resolve/resolvectl.c
@@ -20,6 +20,7 @@
 #include "bus-locator.h"
 #include "bus-util.h"
 #include "crypto-util.h"
+#include "dlopen-note.h"
 #include "dns-configuration.h"
 #include "dns-domain.h"
 #include "dns-packet.h"
@@ -3792,6 +3793,8 @@ static int run(int argc, char **argv) {
         bool compat = false;
         int r;
 
+        LIBCRYPTO_NOTE(suggested);
+
         setlocale(LC_ALL, "");
         log_setup();
 
diff --git a/src/resolve/resolved.c b/src/resolve/resolved.c
index 66171e9b349..ba487c91729 100644
--- a/src/resolve/resolved.c
+++ b/src/resolve/resolved.c
@@ -9,6 +9,7 @@
 #include "bus-object.h"
 #include "capability-util.h"
 #include "daemon-util.h"
+#include "dlopen-note.h"
 #include "label-util.h"
 #include "log.h"
 #include "main-func.h"
@@ -24,6 +25,8 @@ static int run(int argc, char *argv[]) {
         _unused_ _cleanup_(notify_on_cleanup) const char *notify_stop = NULL;
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         r = service_parse_argv("systemd-resolved.service",
diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c
index 1eec7726ef8..17f526b7276 100644
--- a/src/shutdown/shutdown.c
+++ b/src/shutdown/shutdown.c
@@ -24,6 +24,7 @@
 #include "detach-loopback.h"
 #include "detach-md.h"
 #include "detach-swap.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "exec-util.h"
 #include "fd-util.h"
@@ -378,6 +379,8 @@ int main(int argc, char *argv[]) {
         size_t n_luo_fds = 0;
         int cmd, r;
 
+        LIBSELINUX_NOTE(recommended);
+
         /* LUO will preserve these across kexec */
         dual_timestamp_now(&shutdown_late_start);
 
diff --git a/src/socket-activate/socket-activate.c b/src/socket-activate/socket-activate.c
index be0179ccc9e..fa60131ba91 100644
--- a/src/socket-activate/socket-activate.c
+++ b/src/socket-activate/socket-activate.c
@@ -9,6 +9,7 @@
 #include "alloc-util.h"
 #include "build.h"
 #include "daemon-util.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "errno-util.h"
 #include "escape.h"
@@ -468,6 +469,8 @@ static int run(int argc, char **argv) {
         _cleanup_strv_free_ char **exec_argv = NULL;
         int r, n;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         char **args = NULL;
diff --git a/src/ssh-generator/ssh-generator.c b/src/ssh-generator/ssh-generator.c
index 7d67d4178ec..a5ae1110434 100644
--- a/src/ssh-generator/ssh-generator.c
+++ b/src/ssh-generator/ssh-generator.c
@@ -4,6 +4,7 @@
 
 #include "alloc-util.h"
 #include "creds-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "fd-util.h"
 #include "fileio.h"
@@ -450,6 +451,9 @@ static int run(const char *dest, const char *dest_early, const char *dest_late)
 
         assert(dest);
 
+        LIBCRYPTO_NOTE(suggested);
+        TPM2_NOTE(suggested);
+
         r = proc_cmdline_parse(parse_proc_cmdline_item, /* userdata= */ NULL, /* flags= */ 0);
         if (r < 0)
                 log_warning_errno(r, "Failed to parse kernel command line, ignoring: %m");
diff --git a/src/sysext/sysext.c b/src/sysext/sysext.c
index c8c50279f5b..3c308bd8b6a 100644
--- a/src/sysext/sysext.c
+++ b/src/sysext/sysext.c
@@ -28,6 +28,7 @@
 #include "devnum-util.h"
 #include "discover-image.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "errno-util.h"
 #include "escape.h"
@@ -3175,6 +3176,9 @@ static int run(int argc, char *argv[]) {
         char **args = NULL;
         int r;
 
+        LIBCRYPTO_NOTE(suggested);
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         arg_image_class = invoked_as(argv, "systemd-confext") ? IMAGE_CONFEXT : IMAGE_SYSEXT;
diff --git a/src/sysinstall/sysinstall.c b/src/sysinstall/sysinstall.c
index e1346a5e26f..82232f8ccb7 100644
--- a/src/sysinstall/sysinstall.c
+++ b/src/sysinstall/sysinstall.c
@@ -15,6 +15,7 @@
 #include "chase.h"
 #include "conf-files.h"
 #include "constants.h"
+#include "dlopen-note.h"
 #include "efi-loader.h"
 #include "efivars.h"
 #include "env-file.h"
@@ -2068,6 +2069,11 @@ static void end_marker(void) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+
         setlocale(LC_ALL, "");
 
         r = parse_argv(argc, argv);
diff --git a/src/systemctl/systemctl-main.c b/src/systemctl/systemctl-main.c
index 8e2b1c170d5..fea186d9cd2 100644
--- a/src/systemctl/systemctl-main.c
+++ b/src/systemctl/systemctl-main.c
@@ -3,6 +3,7 @@
 #include <locale.h>
 
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "glyph-util.h"
 #include "log.h"
 #include "logs-show.h"
@@ -23,6 +24,13 @@ static int run(int argc, char *argv[]) {
         char **args = STRV_EMPTY;
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         setlocale(LC_ALL, "");
         log_setup();
 
diff --git a/src/sysupdate/sysupdate.c b/src/sysupdate/sysupdate.c
index 16aff0b6812..fe39d31f6a9 100644
--- a/src/sysupdate/sysupdate.c
+++ b/src/sysupdate/sysupdate.c
@@ -14,6 +14,7 @@
 #include "constants.h"
 #include "discover-image.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "errno-util.h"
 #include "fd-util.h"
@@ -2685,6 +2686,11 @@ static int vl_server(void) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+
         log_setup();
 
         char **args = NULL;
diff --git a/src/sysusers/sysusers.c b/src/sysusers/sysusers.c
index 48d256b15c2..c32fb72d5e8 100644
--- a/src/sysusers/sysusers.c
+++ b/src/sysusers/sysusers.c
@@ -11,6 +11,7 @@
 #include "copy.h"
 #include "creds-util.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "extract-word.h"
 #include "fd-util.h"
@@ -2269,6 +2270,14 @@ static int run(int argc, char *argv[]) {
         Item *i;
         int r;
 
+        LIBAUDIT_NOTE(recommended);
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPT_NOTE(recommended);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBCRYPTO_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         char **args = NULL;
         r = parse_argv(argc, argv, &args);
         if (r <= 0)
diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
index 5d20e6ca061..efc255d5e5f 100644
--- a/src/timedate/timedated.c
+++ b/src/timedate/timedated.c
@@ -25,6 +25,7 @@
 #include "conf-files.h"
 #include "constants.h"
 #include "daemon-util.h"
+#include "dlopen-note.h"
 #include "extract-word.h"
 #include "fd-util.h"
 #include "fileio.h"
@@ -1164,6 +1165,8 @@ static int run(int argc, char *argv[]) {
         _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         r = service_parse_argv("systemd-timedated.service",
diff --git a/src/tmpfiles/tmpfiles.c b/src/tmpfiles/tmpfiles.c
index 261a4f0b92a..0667b5b71f8 100644
--- a/src/tmpfiles/tmpfiles.c
+++ b/src/tmpfiles/tmpfiles.c
@@ -25,6 +25,7 @@
 #include "devnum-util.h"
 #include "dirent-util.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "errno-util.h"
 #include "escape.h"
@@ -4853,6 +4854,12 @@ static int run(int argc, char *argv[]) {
         } phase;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBCRYPTO_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         char **args = NULL;
         r = parse_argv(argc, argv, &args);
         if (r <= 0)
diff --git a/src/tpm2-setup/tpm2-clear.c b/src/tpm2-setup/tpm2-clear.c
index 19186ecc02f..fcef2b76bb2 100644
--- a/src/tpm2-setup/tpm2-clear.c
+++ b/src/tpm2-setup/tpm2-clear.c
@@ -4,6 +4,7 @@
 
 #include "alloc-util.h"
 #include "build.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "fileio.h"
 #include "format-table.h"
@@ -110,6 +111,10 @@ static int request_tpm2_clear(void) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBTSS2_ESYS_NOTE(suggested);
+        LIBTSS2_MU_NOTE(suggested);
+        LIBTSS2_RC_NOTE(suggested);
+
         log_setup();
 
         r = parse_argv(argc, argv);
diff --git a/src/tpm2-setup/tpm2-generator.c b/src/tpm2-setup/tpm2-generator.c
index 5a4a88bf9f4..7a826a0be18 100644
--- a/src/tpm2-setup/tpm2-generator.c
+++ b/src/tpm2-setup/tpm2-generator.c
@@ -2,6 +2,7 @@
 
 #include <unistd.h>
 
+#include "dlopen-note.h"
 #include "dropin.h"
 #include "efivars.h"
 #include "generator.h"
@@ -169,6 +170,10 @@ static int run(const char *dest, const char *dest_early, const char *dest_late)
 
         assert_se(arg_dest = dest);
 
+        LIBTSS2_ESYS_NOTE(suggested);
+        LIBTSS2_MU_NOTE(suggested);
+        LIBTSS2_RC_NOTE(suggested);
+
         r = proc_cmdline_parse(parse_proc_cmdline_item, NULL, PROC_CMDLINE_STRIP_RD_PREFIX);
         if (r < 0)
                 log_warning_errno(r, "Failed to parse kernel command line, ignoring: %m");
diff --git a/src/tpm2-setup/tpm2-setup.c b/src/tpm2-setup/tpm2-setup.c
index 897c4daf14f..d655ab46d39 100644
--- a/src/tpm2-setup/tpm2-setup.c
+++ b/src/tpm2-setup/tpm2-setup.c
@@ -10,6 +10,7 @@
 #include "conf-files.h"
 #include "constants.h"
 #include "crypto-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "fd-util.h"
 #include "fileio.h"
@@ -599,6 +600,8 @@ static int run(int argc, char *argv[]) {
                 return EXIT_SUCCESS;
         }
 
+        LIBBLKID_NOTE(recommended);
+
         r = DLOPEN_LIBCRYPTO(LOG_ERR, required);
         if (r < 0)
                 return r;
diff --git a/src/tpm2-setup/tpm2-swtpm.c b/src/tpm2-setup/tpm2-swtpm.c
index 33d5defd060..a97c7c31bed 100644
--- a/src/tpm2-setup/tpm2-swtpm.c
+++ b/src/tpm2-setup/tpm2-swtpm.c
@@ -6,6 +6,7 @@
 
 #include "alloc-util.h"
 #include "chase.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "escape.h"
 #include "fd-util.h"
@@ -145,6 +146,8 @@ static int setup_swtpm(const char *state_dir, int state_fd, const char *secret)
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBBLKID_NOTE(recommended);
+
         log_setup();
 
         _cleanup_free_ char *runtime_dir = NULL;
diff --git a/src/tty-ask-password-agent/tty-ask-password-agent.c b/src/tty-ask-password-agent/tty-ask-password-agent.c
index c7b1fb3e1fb..d57ade56c9e 100644
--- a/src/tty-ask-password-agent/tty-ask-password-agent.c
+++ b/src/tty-ask-password-agent/tty-ask-password-agent.c
@@ -19,6 +19,7 @@
 #include "daemon-util.h"
 #include "devnum-util.h"
 #include "dirent-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "exit-status.h"
 #include "fd-util.h"
@@ -700,6 +701,8 @@ static int ask_on_consoles(char *argv[]) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         umask(0022);
diff --git a/src/udev/udevadm.c b/src/udev/udevadm.c
index 9b7b09370a9..341e00d1186 100644
--- a/src/udev/udevadm.c
+++ b/src/udev/udevadm.c
@@ -3,6 +3,7 @@
 #include <stdio.h>
 
 #include "argv-util.h"
+#include "dlopen-note.h"
 #include "format-table.h"
 #include "help-util.h"
 #include "label-util.h"
@@ -101,6 +102,10 @@ static int run(int argc, char *argv[]) {
         char **args = NULL;
         int r;
 
+        LIBAPPARMOR_NOTE(recommended);
+        LIBAUDIT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         if (invoked_as(argv, "udevd"))
                 return run_udevd(argc, argv);
 
diff --git a/src/update-done/update-done.c b/src/update-done/update-done.c
index 67ce353e114..ceb83374956 100644
--- a/src/update-done/update-done.c
+++ b/src/update-done/update-done.c
@@ -5,6 +5,7 @@
 #include "alloc-util.h"
 #include "build.h"
 #include "chase.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "fd-util.h"
 #include "fileio.h"
@@ -124,6 +125,8 @@ static int run(int argc, char *argv[]) {
         struct stat st;
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         r = parse_argv(argc, argv);
         if (r <= 0)
                 return r;
diff --git a/src/update-utmp/update-utmp.c b/src/update-utmp/update-utmp.c
index d27616c2cd3..3ae949f1148 100644
--- a/src/update-utmp/update-utmp.c
+++ b/src/update-utmp/update-utmp.c
@@ -7,6 +7,7 @@
 #include "bus-error.h"
 #include "bus-locator.h"
 #include "bus-util.h"
+#include "dlopen-note.h"
 #include "libaudit-util.h"
 #include "log.h"
 #include "main-func.h"
@@ -109,6 +110,8 @@ static int run(int argc, char *argv[]) {
                 .audit_fd = -EBADF,
         };
 
+        LIBAUDIT_NOTE(recommended);
+
         log_setup();
 
         umask(0022);
diff --git a/src/user-sessions/user-sessions.c b/src/user-sessions/user-sessions.c
index faf37602af7..f9717b88cc9 100644
--- a/src/user-sessions/user-sessions.c
+++ b/src/user-sessions/user-sessions.c
@@ -2,6 +2,7 @@
 
 #include <sys/stat.h>
 
+#include "dlopen-note.h"
 #include "fs-util.h"
 #include "label-util.h"
 #include "log.h"
@@ -12,6 +13,8 @@
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         if (argc != 2)
                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
                                        "This program requires one argument.");
diff --git a/src/userdb/userdbctl.c b/src/userdb/userdbctl.c
index fd349b28267..e4fd5a9e8d6 100644
--- a/src/userdb/userdbctl.c
+++ b/src/userdb/userdbctl.c
@@ -10,6 +10,7 @@
 #include "copy.h"
 #include "creds-util.h"
 #include "dirent-util.h"
+#include "dlopen-note.h"
 #include "errno-list.h"
 #include "errno-util.h"
 #include "escape.h"
@@ -1853,6 +1854,8 @@ static int run(int argc, char *argv[]) {
         _cleanup_strv_free_ char **args = NULL;
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         r = parse_argv(argc, argv, &args);
diff --git a/src/veritysetup/veritysetup.c b/src/veritysetup/veritysetup.c
index dde1910866b..56c199dbd7f 100644
--- a/src/veritysetup/veritysetup.c
+++ b/src/veritysetup/veritysetup.c
@@ -8,6 +8,7 @@
 #include "alloc-util.h"
 #include "argv-util.h"
 #include "cryptsetup-util.h"
+#include "dlopen-note.h"
 #include "extract-word.h"
 #include "fileio.h"
 #include "format-table.h"
@@ -493,6 +494,8 @@ static int run(int argc, char *argv[]) {
 
         log_setup();
 
+        LIBCRYPTO_NOTE(suggested);
+
         r = DLOPEN_CRYPTSETUP(LOG_ERR, required);
         if (r < 0)
                 return r;
diff --git a/src/vmspawn/vmspawn.c b/src/vmspawn/vmspawn.c
index 2a3ee83512e..460219c1445 100644
--- a/src/vmspawn/vmspawn.c
+++ b/src/vmspawn/vmspawn.c
@@ -29,6 +29,7 @@
 #include "copy.h"
 #include "discover-image.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "escape.h"
 #include "ether-addr-util.h"
 #include "event-util.h"
@@ -4286,6 +4287,9 @@ static int run(int argc, char *argv[]) {
         int r, kvm_device_fd = -EBADF, vhost_device_fd = -EBADF;
         _cleanup_strv_free_ char **names = NULL;
 
+        LIBBLKID_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         arg_runtime_scope = getuid() == 0 ? RUNTIME_SCOPE_SYSTEM : RUNTIME_SCOPE_USER;
diff --git a/src/volatile-root/volatile-root.c b/src/volatile-root/volatile-root.c
index 883f193ff44..9e337958ab0 100644
--- a/src/volatile-root/volatile-root.c
+++ b/src/volatile-root/volatile-root.c
@@ -7,6 +7,7 @@
 #include "blockdev-util.h"
 #include "chase.h"
 #include "devnum-util.h"
+#include "dlopen-note.h"
 #include "escape.h"
 #include "log.h"
 #include "main-func.h"
@@ -122,6 +123,8 @@ static int run(int argc, char *argv[]) {
         dev_t devt;
         int r;
 
+        LIBMOUNT_NOTE(recommended);
+
         log_setup();
 
         if (argc > 3)