diff --git a/src/core/exec-invoke.c b/src/core/exec-invoke.c
index 4560067186..b0f8e1178e 100644
--- a/src/core/exec-invoke.c
+++ b/src/core/exec-invoke.c
@@ -1345,7 +1345,7 @@ static void rename_process_from_path(const char *path) {
         process_name[1+l] = ')';
         process_name[1+l+1] = 0;
 
-        rename_process(process_name);
+        (void) rename_process(process_name);
 }
 
 static bool context_has_address_families(const ExecContext *c) {
diff --git a/src/core/executor.c b/src/core/executor.c
index 993cd4a4d2..51c727f325 100644
--- a/src/core/executor.c
+++ b/src/core/executor.c
@@ -6,6 +6,7 @@
 #include "sd-messages.h"
 
 #include "alloc-util.h"
+#include "argv-util.h"
 #include "build.h"
 #include "exec-invoke.h"
 #include "execute-serialize.h"
@@ -191,6 +192,11 @@ int main(int argc, char *argv[]) {
         exec_context_init(&context);
         cgroup_context_init(&cgroup_context);
 
+        /* We use safe_fork() for spawning sd-pam helper process, which internally calls rename_process().
+         * As the last step of renaming, all saved argvs are memzero()-ed. Hence, we need to save the argv
+         * first to prevent showing "intense" cmdline. See #30352. */
+        save_argc_argv(argc, argv);
+
         /* We might be starting the journal itself, we'll be told by the caller what to do */
         log_set_always_reopen_console(true);
         log_set_prohibit_ipc(true);