diff --git a/src/core/selinux-setup.c b/src/core/selinux-setup.c
index 7135542106..7b69b4c4c6 100644
--- a/src/core/selinux-setup.c
+++ b/src/core/selinux-setup.c
@@ -47,13 +47,15 @@ int mac_selinux_setup(bool *loaded_policy) {
         usec_t before_load, after_load;
         char *con;
         int r;
-        union selinux_callback cb;
+        static const union selinux_callback cb = {
+                .func_log = null_log,
+        };
+
         bool initialized = false;
 
         assert(loaded_policy);
 
         /* Turn off all of SELinux' own logging, we want to do that */
-        cb.func_log = null_log;
         selinux_set_callback(SELINUX_CB_LOG, cb);
 
         /* Don't load policy in the initrd if we don't appear to have