diff --git a/src/analyze/analyze.c b/src/analyze/analyze.c
index 67a9135767..df41db77ad 100644
--- a/src/analyze/analyze.c
+++ b/src/analyze/analyze.c
@@ -55,6 +55,7 @@
 #include "bus-util.h"
 #include "calendarspec.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "extract-word.h"
 #include "format-table.h"
 #include "help-util.h"
@@ -685,6 +686,20 @@ static int run(int argc, char *argv[]) {
         _cleanup_strv_free_ char **args = NULL;
         int r;
 
+        LIBACL_NOTE(recommended);
+        LIBAPPARMOR_NOTE(recommended);
+        LIBAUDIT_NOTE(recommended);
+        LIBBLKID_NOTE(recommended);
+        LIBBPF_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(recommended);
+        LIBDW_NOTE(suggested);
+        LIBELF_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBPCRE2_NOTE(suggested);
+        LIBSELINUX_NOTE(recommended);
+        TPM2_NOTE(suggested);
+
         setlocale(LC_ALL, "");
         setlocale(LC_NUMERIC, "C"); /* we want to format/parse floats in C style */
 
diff --git a/src/bless-boot/bless-boot.c b/src/bless-boot/bless-boot.c
index 4242182ac1..6e31ea72f0 100644
--- a/src/bless-boot/bless-boot.c
+++ b/src/bless-boot/bless-boot.c
@@ -5,6 +5,7 @@
 #include "alloc-util.h"
 #include "build.h"
 #include "devnum-util.h"
+#include "dlopen-note.h"
 #include "efivars.h"
 #include "fd-util.h"
 #include "find-esp.h"
@@ -566,6 +567,8 @@ static int run(int argc, char *argv[]) {
         char **args = NULL;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+
         log_setup();
 
         r = parse_argv(argc, argv, &args);
diff --git a/src/bootctl/bootctl.c b/src/bootctl/bootctl.c
index 6e522f01e6..72d96bc1b0 100644
--- a/src/bootctl/bootctl.c
+++ b/src/bootctl/bootctl.c
@@ -22,6 +22,7 @@
 #include "crypto-util.h"
 #include "devnum-util.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "efi-loader.h"
 #include "efivars.h"
 #include "escape.h"
@@ -858,6 +859,13 @@ static int run(int argc, char *argv[]) {
         _cleanup_(umount_and_freep) char *mounted_dir = NULL;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBTSS2_ESYS_NOTE(suggested);
+        LIBTSS2_MU_NOTE(suggested);
+        LIBTSS2_RC_NOTE(suggested);
+
         log_setup();
 
         char **args = NULL;
diff --git a/src/core/executor.c b/src/core/executor.c
index e771bdc024..d0cd16aa9a 100644
--- a/src/core/executor.c
+++ b/src/core/executor.c
@@ -9,6 +9,7 @@
 #include "build.h"
 #include "capability-util.h"
 #include "cgroup.h"
+#include "dlopen-note.h"
 #include "dynamic-user.h"
 #include "exec-invoke.h"
 #include "execute.h"
@@ -232,6 +233,12 @@ static int run(int argc, char *argv[]) {
 int run_executor(int argc, char *argv[]) {
         int r;
 
+        LIBACL_NOTE(recommended);
+        LIBAPPARMOR_NOTE(recommended);
+        LIBBLKID_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+        TPM2_NOTE(suggested);
+
         /* We use safe_fork() for spawning sd-pam helper process, which internally calls rename_process().
          * As the last step of renaming, all saved argvs are memzero()-ed. Hence, we need to save the argv
          * first to prevent showing "intense" cmdline. See #30352. */
diff --git a/src/core/main.c b/src/core/main.c
index a05715dcfc..84e6c75bef 100644
--- a/src/core/main.c
+++ b/src/core/main.c
@@ -41,6 +41,7 @@
 #include "dbus.h"
 #include "dbus-manager.h"
 #include "dev-setup.h"
+#include "dlopen-note.h"
 #include "efi-random.h"
 #include "emergency-action.h"
 #include "env-util.h"
@@ -4018,6 +4019,18 @@ finish:
 }
 
 int main(int argc, char *argv[]) {
+        LIBACL_NOTE(recommended);
+        LIBAPPARMOR_NOTE(recommended);
+        LIBAUDIT_NOTE(recommended);
+        LIBBLKID_NOTE(recommended);
+        LIBBPF_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(recommended);
+        LIBKMOD_NOTE(recommended);
+        LIBPCRE2_NOTE(suggested);
+        LIBSECCOMP_NOTE(recommended);
+        TPM2_NOTE(suggested);
+
 #if SYSTEMD_MULTICALL_BINARY
         if (invoked_as(argv, "executor"))
                 return run_executor(argc, argv);
diff --git a/src/coredump/coredump.c b/src/coredump/coredump.c
index 6a758ac277..649756d332 100644
--- a/src/coredump/coredump.c
+++ b/src/coredump/coredump.c
@@ -6,6 +6,7 @@
 #include "coredump-kernel-helper.h"
 #include "coredump-receive.h"
 #include "coredump-util.h"
+#include "dlopen-note.h"
 #include "log.h"
 #include "main-func.h"
 #include "string-util.h"
@@ -13,6 +14,12 @@
 static int run(int argc, char *argv[]) {
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBACL_NOTE(recommended);
+        LIBDW_NOTE(suggested);
+        LIBELF_NOTE(suggested);
+        LIBSELINUX_NOTE(recommended);
+
         /* When running as backtrace mode, it is not necessary to use kmsg, not necessary to disable coredump
          * from the command, and unexpectedly passed file descriptors can be silently ignored. */
         if (streq_ptr(argv[1], "--backtrace"))
diff --git a/src/coredump/coredumpctl.c b/src/coredump/coredumpctl.c
index c13cfa1cce..d69137466b 100644
--- a/src/coredump/coredumpctl.c
+++ b/src/coredump/coredumpctl.c
@@ -21,6 +21,7 @@
 #include "chase.h"
 #include "compress.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "escape.h"
 #include "extract-word.h"
@@ -1489,6 +1490,13 @@ static int run(int argc, char *argv[]) {
         char **args = NULL;
         int r, units_active;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBACL_NOTE(recommended);
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+
         setlocale(LC_ALL, "");
         log_setup();
 
diff --git a/src/creds/creds.c b/src/creds/creds.c
index 455b157a02..d559b59e6b 100644
--- a/src/creds/creds.c
+++ b/src/creds/creds.c
@@ -12,6 +12,7 @@
 #include "bus-util.h"
 #include "creds-util.h"
 #include "dirent-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "escape.h"
 #include "fileio.h"
@@ -1467,6 +1468,9 @@ static int vl_server(void) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBCRYPTO_NOTE(suggested);
+        TPM2_NOTE(suggested);
+
         log_setup();
 
         char **args = NULL;
diff --git a/src/cryptenroll/cryptenroll.c b/src/cryptenroll/cryptenroll.c
index 1b5bbc3016..ae70814661 100644
--- a/src/cryptenroll/cryptenroll.c
+++ b/src/cryptenroll/cryptenroll.c
@@ -21,6 +21,7 @@
 #include "cryptenroll-varlink.h"
 #include "cryptenroll-wipe.h"
 #include "cryptsetup-util.h"
+#include "dlopen-note.h"
 #include "extract-word.h"
 #include "format-table.h"
 #include "help-util.h"
@@ -1019,6 +1020,13 @@ static int run(int argc, char *argv[]) {
         _cleanup_(enroll_context_done) EnrollContext c = ENROLL_CONTEXT_NULL;
         int slot, r;
 
+        LIBCRYPTO_NOTE(suggested);
+        LIBFIDO2_NOTE(suggested);
+        LIBP11KIT_NOTE(suggested);
+        LIBQRENCODE_NOTE(suggested);
+        PASSWORD_NOTE(suggested);
+        TPM2_NOTE(suggested);
+
         log_setup();
 
         /* A delicious drop of snake oil */
diff --git a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-fido2.c b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-fido2.c
index 800b297ae8..93be8dcb3c 100644
--- a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-fido2.c
+++ b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-fido2.c
@@ -8,6 +8,7 @@
 #include "alloc-util.h"
 #include "cryptsetup-token.h"
 #include "cryptsetup-token-util.h"
+#include "dlopen-note.h"
 #include "luks2-fido2.h"
 #include "memory-util.h"
 #include "version.h"
@@ -17,7 +18,9 @@
 #define TOKEN_VERSION_MINOR "0"
 
 /* for libcryptsetup debug purpose */
-_public_ const char *cryptsetup_token_version(void) {
+_public_ const char* cryptsetup_token_version(void) {
+        LIBFIDO2_NOTE(suggested);
+
         return TOKEN_VERSION_MAJOR "." TOKEN_VERSION_MINOR " systemd-v" PROJECT_VERSION_FULL " (" GIT_VERSION ")";
 }
 
diff --git a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-pkcs11.c b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-pkcs11.c
index 483686f671..3c55866fb2 100644
--- a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-pkcs11.c
+++ b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-pkcs11.c
@@ -7,6 +7,7 @@
 #include "alloc-util.h"
 #include "cryptsetup-token.h"
 #include "cryptsetup-token-util.h"
+#include "dlopen-note.h"
 #include "luks2-pkcs11.h"
 #include "memory-util.h"
 #include "pkcs11-util.h"
@@ -17,7 +18,10 @@
 #define TOKEN_VERSION_MINOR "0"
 
 /* for libcryptsetup debug purpose */
-_public_ const char *cryptsetup_token_version(void) {
+_public_ const char* cryptsetup_token_version(void) {
+        LIBCRYPTO_NOTE(suggested);
+        LIBP11KIT_NOTE(suggested);
+
         return TOKEN_VERSION_MAJOR "." TOKEN_VERSION_MINOR " systemd-v" PROJECT_VERSION_FULL " (" GIT_VERSION ")";
 }
 
diff --git a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-tpm2.c b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-tpm2.c
index dd1cb77d8c..dc67ebeb7a 100644
--- a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-tpm2.c
+++ b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-tpm2.c
@@ -5,6 +5,7 @@
 #include "alloc-util.h"
 #include "cryptsetup-token.h"
 #include "cryptsetup-token-util.h"
+#include "dlopen-note.h"
 #include "hexdecoct.h"
 #include "json-util.h"
 #include "luks2-tpm2.h"
@@ -18,7 +19,9 @@
 #define TOKEN_VERSION_MINOR "0"
 
 /* for libcryptsetup debug purpose */
-_public_ const char *cryptsetup_token_version(void) {
+_public_ const char* cryptsetup_token_version(void) {
+        LIBCRYPTO_NOTE(suggested);
+        TPM2_NOTE(suggested);
 
         return TOKEN_VERSION_MAJOR "." TOKEN_VERSION_MINOR " systemd-v" PROJECT_VERSION_FULL " (" GIT_VERSION ")";
 }
diff --git a/src/cryptsetup/cryptsetup.c b/src/cryptsetup/cryptsetup.c
index 9be25d004d..db34b7e974 100644
--- a/src/cryptsetup/cryptsetup.c
+++ b/src/cryptsetup/cryptsetup.c
@@ -18,6 +18,7 @@
 #include "cryptsetup-pkcs11.h"
 #include "cryptsetup-tpm2.h"
 #include "cryptsetup-util.h"
+#include "dlopen-note.h"
 #include "efi-api.h"
 #include "efi-loader.h"
 #include "efivars.h"
@@ -2884,6 +2885,12 @@ static int verb_detach(int argc, char *argv[], uintptr_t _data, void *userdata)
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBFIDO2_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBP11KIT_NOTE(suggested);
+        TPM2_NOTE(suggested);
+
         log_setup();
 
         umask(0022);
diff --git a/src/debug-generator/debug-generator.c b/src/debug-generator/debug-generator.c
index 700ad52893..c0c799b06f 100644
--- a/src/debug-generator/debug-generator.c
+++ b/src/debug-generator/debug-generator.c
@@ -5,6 +5,7 @@
 #include "alloc-util.h"
 #include "bitfield.h"
 #include "creds-util.h"
+#include "dlopen-note.h"
 #include "dropin.h"
 #include "errno-util.h"
 #include "extract-word.h"
@@ -364,6 +365,9 @@ static int run(const char *dest, const char *dest_early, const char *dest_late)
         const char *credentials_dir;
         int r;
 
+        LIBCRYPTO_NOTE(suggested);
+        TPM2_NOTE(suggested);
+
         assert_se(arg_dest = dest_early);
 
         r = proc_cmdline_parse(parse_proc_cmdline_item, NULL, PROC_CMDLINE_RD_STRICT | PROC_CMDLINE_STRIP_RD_PREFIX);
diff --git a/src/dissect/dissect.c b/src/dissect/dissect.c
index e3db8470b6..352d7ffa91 100644
--- a/src/dissect/dissect.c
+++ b/src/dissect/dissect.c
@@ -19,6 +19,7 @@
 #include "device-util.h"
 #include "discover-image.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "errno-util.h"
 #include "escape.h"
@@ -1968,6 +1969,13 @@ static int run(int argc, char *argv[]) {
         _cleanup_close_ int userns_fd = -EBADF;
         int r;
 
+        LIBACL_NOTE(recommended);
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         if (invoked_as(argv, "mount.ddi"))
diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
index e81923beb5..55b4f922c1 100644
--- a/src/firstboot/firstboot.c
+++ b/src/firstboot/firstboot.c
@@ -20,6 +20,7 @@
 #include "copy.h"
 #include "creds-util.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "env-file.h"
 #include "errno-util.h"
 #include "fd-util.h"
@@ -1702,6 +1703,14 @@ static int run(int argc, char *argv[]) {
         _cleanup_close_ int rfd = -EBADF;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPT_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+        PASSWORD_NOTE(suggested);
+
         r = parse_argv(argc, argv);
         if (r <= 0)
                 return r;
diff --git a/src/fstab-generator/fstab-generator.c b/src/fstab-generator/fstab-generator.c
index 3a5ce47691..b723868f51 100644
--- a/src/fstab-generator/fstab-generator.c
+++ b/src/fstab-generator/fstab-generator.c
@@ -14,6 +14,7 @@
 #include "bus-util.h"
 #include "chase.h"
 #include "creds-util.h"
+#include "dlopen-note.h"
 #include "efi-loader.h"
 #include "env-util.h"
 #include "errno-util.h"
@@ -1729,6 +1730,11 @@ static int run_generator(void) {
 }
 
 static int run(int argc, char **argv) {
+        LIBCRYPTO_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+        TPM2_NOTE(suggested);
+
         arg_sysroot_check = invoked_as(argv, "systemd-sysroot-fstab-check");
 
         if (arg_sysroot_check) {
diff --git a/src/getty-generator/getty-generator.c b/src/getty-generator/getty-generator.c
index 69ef0aae04..62e0735dd7 100644
--- a/src/getty-generator/getty-generator.c
+++ b/src/getty-generator/getty-generator.c
@@ -5,6 +5,7 @@
 
 #include "alloc-util.h"
 #include "creds-util.h"
+#include "dlopen-note.h"
 #include "extract-word.h"
 #include "fd-util.h"
 #include "fileio.h"
@@ -277,6 +278,9 @@ static int run(const char *dest, const char *dest_early, const char *dest_late)
 
         assert_se(arg_dest = dest);
 
+        LIBCRYPTO_NOTE(suggested);
+        TPM2_NOTE(suggested);
+
         if (in_initrd()) {
                 log_debug("Skipping generator, running in the initrd.");
                 return EXIT_SUCCESS;
diff --git a/src/gpt-auto-generator/gpt-auto-generator.c b/src/gpt-auto-generator/gpt-auto-generator.c
index b92ac8f66a..5305957bd9 100644
--- a/src/gpt-auto-generator/gpt-auto-generator.c
+++ b/src/gpt-auto-generator/gpt-auto-generator.c
@@ -9,6 +9,7 @@
 #include "device-util.h"
 #include "devnum-util.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "dropin.h"
 #include "efi-loader.h"
 #include "efivars.h"
@@ -1359,6 +1360,10 @@ static int parse_proc_cmdline_item(const char *key, const char *value, void *dat
 static int run(const char *dest, const char *dest_early, const char *dest_late) {
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         assert_se(arg_dest = dest);
         assert_se(arg_dest_late = dest_late);
 
diff --git a/src/growfs/growfs.c b/src/growfs/growfs.c
index f54266a110..e9b34529b5 100644
--- a/src/growfs/growfs.c
+++ b/src/growfs/growfs.c
@@ -11,6 +11,7 @@
 #include "device-util.h"
 #include "devnum-util.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "fd-util.h"
 #include "format-table.h"
 #include "format-util.h"
@@ -192,6 +193,8 @@ static int run(int argc, char *argv[]) {
         dev_t devno;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+
         log_setup();
 
         r = parse_argv(argc, argv);
diff --git a/src/growfs/makefs.c b/src/growfs/makefs.c
index 3747bc0ee2..26d3f5a4bf 100644
--- a/src/growfs/makefs.c
+++ b/src/growfs/makefs.c
@@ -7,6 +7,7 @@
 #include "alloc-util.h"
 #include "blockdev-util.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "fd-util.h"
 #include "log.h"
 #include "main-func.h"
@@ -20,6 +21,9 @@ static int run(int argc, char *argv[]) {
         struct stat st;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBMOUNT_NOTE(recommended);
+
         log_setup();
 
         if (argc != 3)
diff --git a/src/home/homectl.c b/src/home/homectl.c
index 84e3ea1205..f4be3c0e70 100644
--- a/src/home/homectl.c
+++ b/src/home/homectl.c
@@ -19,6 +19,7 @@
 #include "creds-util.h"
 #include "crypto-util.h"
 #include "dirent-util.h"
+#include "dlopen-note.h"
 #include "dns-domain.h"
 #include "env-util.h"
 #include "errno-util.h"
@@ -5183,6 +5184,12 @@ static int run(int argc, char *argv[]) {
         char **args = NULL;
         int r;
 
+        LIBCRYPT_NOTE(recommended);
+        LIBFIDO2_NOTE(suggested);
+        LIBP11KIT_NOTE(suggested);
+        LIBQRENCODE_NOTE(suggested);
+        PASSWORD_NOTE(suggested);
+
         log_setup();
 
         r = redirect_bus_mgr();
diff --git a/src/home/homed.c b/src/home/homed.c
index 753aa95eb3..fc573c5f78 100644
--- a/src/home/homed.c
+++ b/src/home/homed.c
@@ -7,6 +7,7 @@
 #include "bus-log-control-api.h"
 #include "bus-object.h"
 #include "daemon-util.h"
+#include "dlopen-note.h"
 #include "homed-manager.h"
 #include "homed-manager-bus.h"
 #include "log.h"
@@ -18,6 +19,9 @@ static int run(int argc, char *argv[]) {
         _unused_ _cleanup_(notify_on_cleanup) const char *notify_stop = NULL;
         int r;
 
+        LIBCRYPT_NOTE(recommended);
+        PASSWORD_NOTE(suggested);
+
         log_setup();
 
         r = service_parse_argv("systemd-homed.service",
diff --git a/src/home/homework.c b/src/home/homework.c
index 81775e8872..7e48f01206 100644
--- a/src/home/homework.c
+++ b/src/home/homework.c
@@ -13,6 +13,7 @@
 #include "chown-recursive.h"
 #include "copy.h"
 #include "cryptsetup-util.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "errno-util.h"
 #include "fd-util.h"
@@ -1998,6 +1999,12 @@ static int run(int argc, char *argv[]) {
         sd_json_variant *fdmap, *blob_fd_variant;
         int r;
 
+        LIBCRYPT_NOTE(recommended);
+        LIBFIDO2_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBP11KIT_NOTE(suggested);
+        LIBSELINUX_NOTE(recommended);
+
         start = now(CLOCK_MONOTONIC);
 
         log_setup();
diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
index 99de3f23f6..98ade098a7 100644
--- a/src/hostname/hostnamed.c
+++ b/src/hostname/hostnamed.c
@@ -22,6 +22,7 @@
 #include "daemon-util.h"
 #include "device-private.h"
 #include "device-util.h"
+#include "dlopen-note.h"
 #include "env-file.h"
 #include "env-util.h"
 #include "extract-word.h"
@@ -2659,6 +2660,8 @@ static int run(int argc, char *argv[]) {
         };
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         r = service_parse_argv("systemd-hostnamed.service",
diff --git a/src/hwdb/hwdb.c b/src/hwdb/hwdb.c
index 4d2d6fe8c4..c172153bc2 100644
--- a/src/hwdb/hwdb.c
+++ b/src/hwdb/hwdb.c
@@ -2,6 +2,7 @@
 
 #include "alloc-util.h"
 #include "build.h"
+#include "dlopen-note.h"
 #include "format-table.h"
 #include "hwdb-util.h"
 #include "label-util.h"
@@ -114,6 +115,8 @@ static int parse_argv(int argc, char *argv[], char ***ret_args) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         char **args = NULL;
diff --git a/src/import/export.c b/src/import/export.c
index 0b6d27b9ff..2e1576c467 100644
--- a/src/import/export.c
+++ b/src/import/export.c
@@ -9,6 +9,7 @@
 #include "ansi-color.h"
 #include "build.h"
 #include "discover-image.h"
+#include "dlopen-note.h"
 #include "export-raw.h"
 #include "export-tar.h"
 #include "fd-util.h"
@@ -282,6 +283,9 @@ static int parse_argv(int argc, char *argv[], char ***ret_args) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        ARCHIVE_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         setlocale(LC_ALL, "");
         log_setup();
 
diff --git a/src/import/import-fs.c b/src/import/import-fs.c
index dcb0f8c511..fd54faefc0 100644
--- a/src/import/import-fs.c
+++ b/src/import/import-fs.c
@@ -9,6 +9,7 @@
 #include "build.h"
 #include "copy.h"
 #include "discover-image.h"
+#include "dlopen-note.h"
 #include "fd-util.h"
 #include "format-table.h"
 #include "format-util.h"
@@ -392,6 +393,8 @@ static int parse_argv(int argc, char *argv[], char ***ret_args) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         setlocale(LC_ALL, "");
         log_setup();
 
diff --git a/src/import/import-generator.c b/src/import/import-generator.c
index f176492a54..46b605b995 100644
--- a/src/import/import-generator.c
+++ b/src/import/import-generator.c
@@ -5,6 +5,7 @@
 #include "alloc-util.h"
 #include "creds-util.h"
 #include "discover-image.h"
+#include "dlopen-note.h"
 #include "efivars.h"
 #include "errno-util.h"
 #include "extract-word.h"
@@ -426,6 +427,9 @@ static int generate(void) {
 static int run(const char *dest, const char *dest_early, const char *dest_late) {
         int r;
 
+        LIBCRYPTO_NOTE(suggested);
+        TPM2_NOTE(suggested);
+
         assert_se(arg_dest = dest);
 
         r = proc_cmdline_parse(parse_proc_cmdline_item, NULL, PROC_CMDLINE_RD_STRICT|PROC_CMDLINE_STRIP_RD_PREFIX);
diff --git a/src/import/import.c b/src/import/import.c
index 18276fa72d..782557a221 100644
--- a/src/import/import.c
+++ b/src/import/import.c
@@ -9,6 +9,7 @@
 #include "ansi-color.h"
 #include "build.h"
 #include "discover-image.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "fd-util.h"
 #include "format-table.h"
@@ -469,6 +470,9 @@ static void parse_env(void) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        ARCHIVE_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         setlocale(LC_ALL, "");
         log_setup();
 
diff --git a/src/import/importd.c b/src/import/importd.c
index c329491386..5220b3ba03 100644
--- a/src/import/importd.c
+++ b/src/import/importd.c
@@ -19,6 +19,7 @@
 #include "constants.h"
 #include "daemon-util.h"
 #include "discover-image.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "event-util.h"
 #include "fd-util.h"
@@ -2081,6 +2082,8 @@ static int run(int argc, char *argv[]) {
         RuntimeScope scope = RUNTIME_SCOPE_SYSTEM;
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         r = service_parse_argv("systemd-importd.service",
diff --git a/src/import/pull.c b/src/import/pull.c
index 09294bc6fc..7fe3a7e4dd 100644
--- a/src/import/pull.c
+++ b/src/import/pull.c
@@ -9,6 +9,7 @@
 #include "ansi-color.h"
 #include "build.h"
 #include "discover-image.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "format-table.h"
 #include "hexdecoct.h"
@@ -608,6 +609,10 @@ static void parse_env(void) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        ARCHIVE_NOTE(recommended);
+        LIBCURL_NOTE(suggested);
+        LIBSELINUX_NOTE(recommended);
+
         setlocale(LC_ALL, "");
         log_setup();
 
diff --git a/src/journal-remote/journal-gatewayd.c b/src/journal-remote/journal-gatewayd.c
index a6ef7c77fa..9def4a3bc9 100644
--- a/src/journal-remote/journal-gatewayd.c
+++ b/src/journal-remote/journal-gatewayd.c
@@ -1259,6 +1259,9 @@ static int run(int argc, char *argv[]) {
                 MHD_USE_THREAD_PER_CONNECTION;
         int r, n;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBGNUTLS_NOTE(suggested);
+
         log_setup();
 
         r = parse_argv(argc, argv);
diff --git a/src/journal-remote/journal-remote-main.c b/src/journal-remote/journal-remote-main.c
index ff283a2ea5..504471fc8a 100644
--- a/src/journal-remote/journal-remote-main.c
+++ b/src/journal-remote/journal-remote-main.c
@@ -9,6 +9,7 @@
 #include "build.h"
 #include "conf-parser.h"
 #include "daemon-util.h"
+#include "dlopen-note.h"
 #include "extract-word.h"
 #include "fd-util.h"
 #include "format-table.h"
@@ -1165,6 +1166,11 @@ static int run(int argc, char **argv) {
         _cleanup_free_ char *cert = NULL, *trust = NULL;
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBCRYPTO_NOTE(suggested);
+        LIBGNUTLS_NOTE(suggested);
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         journal_auth_init();
diff --git a/src/journal-remote/journal-upload.c b/src/journal-remote/journal-upload.c
index a24f577c89..48a8df559e 100644
--- a/src/journal-remote/journal-upload.c
+++ b/src/journal-remote/journal-upload.c
@@ -12,6 +12,7 @@
 #include "conf-parser.h"
 #include "curl-util.h"
 #include "daemon-util.h"
+#include "dlopen-note.h"
 #include "env-file.h"
 #include "extract-word.h"
 #include "fd-util.h"
@@ -869,6 +870,8 @@ static int run(int argc, char **argv) {
         bool use_journal;
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+
         log_setup();
 
         r = parse_config();
diff --git a/src/journal/bsod.c b/src/journal/bsod.c
index e380e08b1c..9a9067088c 100644
--- a/src/journal/bsod.c
+++ b/src/journal/bsod.c
@@ -8,6 +8,7 @@
 
 #include "alloc-util.h"
 #include "build.h"
+#include "dlopen-note.h"
 #include "fd-util.h"
 #include "fileio.h"
 #include "format-table.h"
@@ -287,6 +288,9 @@ static int run(int argc, char *argv[]) {
         _cleanup_free_ char *message = NULL;
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBQRENCODE_NOTE(suggested);
+
         log_setup();
 
         r = parse_argv(argc, argv);
diff --git a/src/journal/journalctl.c b/src/journal/journalctl.c
index 71f4f717f4..bb5b376a93 100644
--- a/src/journal/journalctl.c
+++ b/src/journal/journalctl.c
@@ -7,6 +7,7 @@
 
 #include "build.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "extract-word.h"
 #include "format-table.h"
 #include "glob-util.h"
@@ -1021,6 +1022,14 @@ static int run(int argc, char *argv[]) {
         _cleanup_strv_free_ char **args = NULL;
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBACL_NOTE(recommended);
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBPCRE2_NOTE(suggested);
+        LIBQRENCODE_NOTE(suggested);
+
         setlocale(LC_ALL, "");
         log_setup();
 
diff --git a/src/journal/journald.c b/src/journal/journald.c
index 91f02178f5..3cab48f6b7 100644
--- a/src/journal/journald.c
+++ b/src/journal/journald.c
@@ -6,6 +6,7 @@
 #include "sd-event.h"
 #include "sd-messages.h"
 
+#include "dlopen-note.h"
 #include "format-util.h"
 #include "journal-authenticate.h"
 #include "journald-kmsg.h"
@@ -25,6 +26,12 @@ static int run(int argc, char *argv[]) {
         LogTarget log_target;
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBACL_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBPCRE2_NOTE(suggested);
+        LIBSELINUX_NOTE(recommended);
+
         if (argc > 2)
                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "This program takes one or no arguments.");
 
diff --git a/src/kernel-install/kernel-install.c b/src/kernel-install/kernel-install.c
index 132ae803df..69fdbcfc34 100644
--- a/src/kernel-install/kernel-install.c
+++ b/src/kernel-install/kernel-install.c
@@ -12,6 +12,7 @@
 #include "chase.h"
 #include "conf-files.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "env-file.h"
 #include "env-util.h"
 #include "exec-util.h"
@@ -1664,6 +1665,11 @@ static int parse_argv(int argc, char *argv[], char ***remaining_args) {
 static int run(int argc, char* argv[]) {
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+
         log_setup();
 
         char **args = NULL;
diff --git a/src/locale/localed.c b/src/locale/localed.c
index 4296db6f2f..a6ff82ffbc 100644
--- a/src/locale/localed.c
+++ b/src/locale/localed.c
@@ -15,6 +15,7 @@
 #include "bus-util.h"
 #include "constants.h"
 #include "daemon-util.h"
+#include "dlopen-note.h"
 #include "hashmap.h"
 #include "label-util.h"
 #include "localed-util.h"
@@ -632,6 +633,8 @@ static int run(int argc, char *argv[]) {
         _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         r = service_parse_argv("systemd-localed.service",
diff --git a/src/login/loginctl.c b/src/login/loginctl.c
index 19ee4c5b75..be67025421 100644
--- a/src/login/loginctl.c
+++ b/src/login/loginctl.c
@@ -17,6 +17,7 @@
 #include "bus-util.h"
 #include "cgroup-show.h"
 #include "cgroup-util.h"
+#include "dlopen-note.h"
 #include "format-table.h"
 #include "format-util.h"
 #include "help-util.h"
@@ -1661,6 +1662,8 @@ static int run(int argc, char *argv[]) {
         char **args = NULL;
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+
         setlocale(LC_ALL, "");
         log_setup();
 
diff --git a/src/login/logind.c b/src/login/logind.c
index fb8e841b9d..9fcf57ab91 100644
--- a/src/login/logind.c
+++ b/src/login/logind.c
@@ -17,6 +17,7 @@
 #include "device-util.h"
 #include "devnum-util.h"
 #include "dirent-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "escape.h"
 #include "fd-util.h"
@@ -1351,6 +1352,10 @@ static int run(int argc, char *argv[]) {
         _unused_ _cleanup_(notify_on_cleanup) const char *notify_message = NULL;
         int r;
 
+        LIBACL_NOTE(recommended);
+        LIBBLKID_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         log_set_facility(LOG_AUTH);
         log_setup();
 
diff --git a/src/login/user-runtime-dir.c b/src/login/user-runtime-dir.c
index bc522bcbca..728b15f4d3 100644
--- a/src/login/user-runtime-dir.c
+++ b/src/login/user-runtime-dir.c
@@ -8,6 +8,7 @@
 #include "bus-error.h"
 #include "bus-locator.h"
 #include "devnum-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "fd-util.h"
 #include "format-util.h"
@@ -327,6 +328,9 @@ static int do_tmpfs_quota(UserRecord *ur) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         if (argc != 3)
diff --git a/src/machine-id-setup/machine-id-setup-main.c b/src/machine-id-setup/machine-id-setup-main.c
index 2363427b5f..1eb372be64 100644
--- a/src/machine-id-setup/machine-id-setup-main.c
+++ b/src/machine-id-setup/machine-id-setup-main.c
@@ -5,6 +5,7 @@
 #include "alloc-util.h"
 #include "build.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "format-table.h"
 #include "id128-util.h"
 #include "image-policy.h"
@@ -131,6 +132,12 @@ static int run(int argc, char *argv[]) {
         _cleanup_(umount_and_freep) char *mounted_dir = NULL;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        TPM2_NOTE(suggested);
+
         log_setup();
 
         r = parse_argv(argc, argv);
diff --git a/src/machine/machinectl.c b/src/machine/machinectl.c
index b0efb6ec02..dc2381fc84 100644
--- a/src/machine/machinectl.c
+++ b/src/machine/machinectl.c
@@ -26,6 +26,7 @@
 #include "bus-wait-for-jobs.h"
 #include "cgroup-show.h"
 #include "cgroup-util.h"
+#include "dlopen-note.h"
 #include "edit-util.h"
 #include "env-util.h"
 #include "fd-util.h"
@@ -2634,6 +2635,9 @@ static int run(int argc, char *argv[]) {
         _cleanup_strv_free_ char **args = NULL;
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBSELINUX_NOTE(recommended);
+
         setlocale(LC_ALL, "");
         log_setup();
 
diff --git a/src/machine/machined.c b/src/machine/machined.c
index 954e260692..47b7650caf 100644
--- a/src/machine/machined.c
+++ b/src/machine/machined.c
@@ -16,6 +16,7 @@
 #include "constants.h"
 #include "daemon-util.h"
 #include "dirent-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "fd-util.h"
 #include "hash-funcs.h"
@@ -347,6 +348,12 @@ static int run(int argc, char *argv[]) {
         RuntimeScope scope = RUNTIME_SCOPE_SYSTEM;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         log_set_facility(LOG_AUTH);
         log_setup();
 
diff --git a/src/measure/measure-tool.c b/src/measure/measure-tool.c
index 893fd4e593..b224f95b35 100644
--- a/src/measure/measure-tool.c
+++ b/src/measure/measure-tool.c
@@ -8,6 +8,7 @@
 #include "ask-password-api.h"
 #include "build.h"
 #include "crypto-util.h"
+#include "dlopen-note.h"
 #include "efi-loader.h"
 #include "efivars.h"
 #include "fd-util.h"
@@ -1130,6 +1131,8 @@ static int verb_policy_digest(int argc, char *argv[], uintptr_t _data, void *use
 static int run(int argc, char *argv[]) {
         int r;
 
+        TPM2_NOTE(suggested);
+
         log_setup();
 
         char **args = NULL;
diff --git a/src/modules-load/modules-load.c b/src/modules-load/modules-load.c
index eb58b70c7b..85452f62a5 100644
--- a/src/modules-load/modules-load.c
+++ b/src/modules-load/modules-load.c
@@ -12,6 +12,7 @@
 #include "conf-files.h"
 #include "constants.h"
 #include "cpu-set-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "fd-util.h"
 #include "fileio.h"
@@ -390,6 +391,8 @@ static int run(int argc, char *argv[]) {
         char *module;
         int ret = 0, r;
 
+        LIBKMOD_NOTE(required);
+
         char **args = NULL;
         r = parse_argv(argc, argv, &args);
         if (r <= 0)
diff --git a/src/mount/mount-tool.c b/src/mount/mount-tool.c
index c35769e56a..58b689190d 100644
--- a/src/mount/mount-tool.c
+++ b/src/mount/mount-tool.c
@@ -14,6 +14,7 @@
 #include "chase.h"
 #include "device-private.h"
 #include "device-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "escape.h"
 #include "fd-util.h"
@@ -1479,6 +1480,8 @@ static int run(int argc, char* argv[]) {
         char **args = NULL;
         int r;
 
+        LIBMOUNT_NOTE(recommended);
+
         log_setup();
 
         r = parse_argv(argc, argv, &args);
diff --git a/src/mountfsd/mountwork.c b/src/mountfsd/mountwork.c
index 4cd4e4abdd..af84ace1eb 100644
--- a/src/mountfsd/mountwork.c
+++ b/src/mountfsd/mountwork.c
@@ -15,6 +15,7 @@
 #include "chase.h"
 #include "discover-image.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "errno-util.h"
 #include "escape.h"
@@ -1489,6 +1490,11 @@ static int run(int argc, char *argv[]) {
         unsigned n_iterations = 0;
         int m, listen_fd, r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+
         log_setup();
 
         m = sd_listen_fds(false);
diff --git a/src/mstack/mstack-tool.c b/src/mstack/mstack-tool.c
index 244e7dc682..45c699d574 100644
--- a/src/mstack/mstack-tool.c
+++ b/src/mstack/mstack-tool.c
@@ -6,6 +6,7 @@
 #include "argv-util.h"
 #include "build.h"
 #include "chase.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "extract-word.h"
 #include "fd-util.h"
@@ -376,6 +377,11 @@ static int umount_mstack(void) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+
         log_setup();
 
         if (invoked_as(argv, "mount.mstack"))
diff --git a/src/network/generator/network-generator-main.c b/src/network/generator/network-generator-main.c
index df9ce9265d..ae15dff2b1 100644
--- a/src/network/generator/network-generator-main.c
+++ b/src/network/generator/network-generator-main.c
@@ -5,6 +5,7 @@
 #include "alloc-util.h"
 #include "build.h"
 #include "creds-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "fd-util.h"
 #include "format-table.h"
@@ -197,6 +198,8 @@ static int run(int argc, char *argv[]) {
         _cleanup_(context_clear) Context context = {};
         int r, ret = 0;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         umask(0022);
diff --git a/src/network/networkctl.c b/src/network/networkctl.c
index bf74f10a4a..f85c74b6af 100644
--- a/src/network/networkctl.c
+++ b/src/network/networkctl.c
@@ -4,6 +4,7 @@
 
 #include "alloc-util.h"
 #include "build.h"
+#include "dlopen-note.h"
 #include "format-table.h"
 #include "help-util.h"
 #include "log.h"
@@ -208,6 +209,9 @@ static int run(int argc, char* argv[]) {
         char **args = NULL;
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         r = parse_argv(argc, argv, &args);
diff --git a/src/network/networkd.c b/src/network/networkd.c
index 230339ba0c..9415c09025 100644
--- a/src/network/networkd.c
+++ b/src/network/networkd.c
@@ -9,6 +9,7 @@
 #include "bus-object.h"
 #include "capability-util.h"
 #include "daemon-util.h"
+#include "dlopen-note.h"
 #include "main-func.h"
 #include "mkdir.h"
 #include "networkd-conf.h"
@@ -24,6 +25,15 @@ static int run(int argc, char *argv[]) {
         _unused_ _cleanup_(notify_on_cleanup) const char *notify_message = NULL;
         int r;
 
+        LIBAPPARMOR_NOTE(recommended);
+        LIBAUDIT_NOTE(recommended);
+        LIBIDN2_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+        LIBTSS2_ESYS_NOTE(suggested);
+        LIBTSS2_MU_NOTE(suggested);
+        LIBTSS2_RC_NOTE(suggested);
+
         log_setup();
 
         r = service_parse_argv("systemd-networkd.service",
diff --git a/src/nspawn/meson.build b/src/nspawn/meson.build
index ddf859c63d..366cec23f6 100644
--- a/src/nspawn/meson.build
+++ b/src/nspawn/meson.build
@@ -47,7 +47,11 @@ executables += [
                         executable_template['include_directories'],
                 ],
                 'dependencies' : [
+                        libacl_cflags,
+                        libblkid_cflags,
+                        libcryptsetup_cflags,
                         libmount_cflags,
+                        libopenssl_cflags,
                         libseccomp_cflags,
                         libselinux_cflags,
                 ],
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index c4dfc9584e..f4d85c0418 100644
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -20,9 +20,11 @@
 #include "sd-path.h"
 #include "sd-varlink.h"
 
+#include "acl-util.h"
 #include "alloc-util.h"
 #include "barrier.h"
 #include "base-filesystem.h"
+#include "blkid-util.h"
 #include "btrfs-util.h"
 #include "build.h"
 #include "bus-error.h"
@@ -36,12 +38,13 @@
 #include "constants.h"
 #include "copy.h"
 #include "cpu-set-util.h"
+#include "crypto-util.h"
+#include "cryptsetup-util.h"
 #include "daemon-util.h"
 #include "dev-setup.h"
 #include "devnum-util.h"
 #include "discover-image.h"
 #include "dissect-image.h"
-#include "dlfcn-util.h"
 #include "env-util.h"
 #include "escape.h"
 #include "ether-addr-util.h"
@@ -6141,6 +6144,10 @@ static int run(int argc, char *argv[]) {
         if (arg_cleanup)
                 return do_cleanup();
 
+        (void) DLOPEN_CRYPTSETUP(LOG_DEBUG, suggested);
+        (void) DLOPEN_LIBACL(LOG_DEBUG, recommended);
+        (void) DLOPEN_LIBBLKID(LOG_DEBUG, recommended);
+        (void) DLOPEN_LIBCRYPTO(LOG_WARNING, recommended);
         (void) DLOPEN_LIBMOUNT(LOG_DEBUG, recommended);
         (void) DLOPEN_LIBSECCOMP(LOG_DEBUG, recommended);
         (void) DLOPEN_LIBSELINUX(LOG_DEBUG, recommended);
diff --git a/src/pcrextend/pcrextend.c b/src/pcrextend/pcrextend.c
index ab212600df..693435f3a4 100644
--- a/src/pcrextend/pcrextend.c
+++ b/src/pcrextend/pcrextend.c
@@ -7,6 +7,7 @@
 #include "alloc-util.h"
 #include "build.h"
 #include "crypto-util.h"
+#include "dlopen-note.h"
 #include "efi-loader.h"
 #include "escape.h"
 #include "format-table.h"
@@ -512,6 +513,9 @@ static int run(int argc, char *argv[]) {
         Tpm2UserspaceEventType event = _TPM2_USERSPACE_EVENT_TYPE_INVALID;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        TPM2_NOTE(suggested);
+
         log_setup();
 
         char **args = NULL;
diff --git a/src/pcrlock/pcrlock.c b/src/pcrlock/pcrlock.c
index d51215d522..2d084d8eb1 100644
--- a/src/pcrlock/pcrlock.c
+++ b/src/pcrlock/pcrlock.c
@@ -21,6 +21,7 @@
 #include "copy.h"
 #include "creds-util.h"
 #include "crypto-util.h"
+#include "dlopen-note.h"
 #include "efi-api.h"
 #include "efivars.h"
 #include "env-util.h"
@@ -5698,6 +5699,10 @@ static int vl_method_on_completed_update(sd_varlink *link, sd_json_variant *para
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+        TPM2_NOTE(suggested);
+
         log_setup();
 
         r = mac_init();
diff --git a/src/portable/portabled.c b/src/portable/portabled.c
index 23982c6ede..2a8bdc36c7 100644
--- a/src/portable/portabled.c
+++ b/src/portable/portabled.c
@@ -12,6 +12,7 @@
 #include "common-signal.h"
 #include "constants.h"
 #include "daemon-util.h"
+#include "dlopen-note.h"
 #include "hashmap.h"
 #include "log.h"
 #include "main-func.h"
@@ -143,6 +144,10 @@ static int run(int argc, char *argv[]) {
         RuntimeScope scope = RUNTIME_SCOPE_SYSTEM;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         r = service_parse_argv("systemd-portabled.service",
diff --git a/src/pstore/pstore.c b/src/pstore/pstore.c
index 3e84b25bfb..35e03a814d 100644
--- a/src/pstore/pstore.c
+++ b/src/pstore/pstore.c
@@ -13,6 +13,7 @@
 #include "conf-parser.h"
 #include "copy.h"
 #include "dirent-util.h"
+#include "dlopen-note.h"
 #include "fd-util.h"
 #include "fileio.h"
 #include "iovec-util.h"
@@ -309,6 +310,8 @@ static int run(int argc, char *argv[]) {
         _cleanup_(pstore_entries_reset) PStoreList list = {};
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         if (argc == 3) {
diff --git a/src/remount-fs/remount-fs.c b/src/remount-fs/remount-fs.c
index 698bb80a4f..1d5457728f 100644
--- a/src/remount-fs/remount-fs.c
+++ b/src/remount-fs/remount-fs.c
@@ -5,6 +5,7 @@
 #include <unistd.h>
 
 #include "alloc-util.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "exit-status.h"
 #include "format-util.h"
@@ -122,6 +123,8 @@ static int run(int argc, char *argv[]) {
         _cleanup_hashmap_free_ Hashmap *pids = NULL;
         int r;
 
+        LIBMOUNT_NOTE(recommended);
+
         log_setup();
 
         if (argc > 1)
diff --git a/src/repart/repart.c b/src/repart/repart.c
index 099b901226..3eada3bc42 100644
--- a/src/repart/repart.c
+++ b/src/repart/repart.c
@@ -11614,6 +11614,9 @@ static int run(int argc, char *argv[]) {
         bool node_is_our_loop = false;
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+        TPM2_NOTE(suggested);
+
         log_setup();
 
         r = parse_argv(argc, argv);
diff --git a/src/resolve/resolvectl.c b/src/resolve/resolvectl.c
index 011162865b..ea6ee54ba6 100644
--- a/src/resolve/resolvectl.c
+++ b/src/resolve/resolvectl.c
@@ -20,6 +20,7 @@
 #include "bus-locator.h"
 #include "bus-util.h"
 #include "crypto-util.h"
+#include "dlopen-note.h"
 #include "dns-configuration.h"
 #include "dns-domain.h"
 #include "dns-packet.h"
@@ -3792,6 +3793,8 @@ static int run(int argc, char **argv) {
         bool compat = false;
         int r;
 
+        LIBCRYPTO_NOTE(suggested);
+
         setlocale(LC_ALL, "");
         log_setup();
 
diff --git a/src/resolve/resolved.c b/src/resolve/resolved.c
index 66171e9b34..ba487c9172 100644
--- a/src/resolve/resolved.c
+++ b/src/resolve/resolved.c
@@ -9,6 +9,7 @@
 #include "bus-object.h"
 #include "capability-util.h"
 #include "daemon-util.h"
+#include "dlopen-note.h"
 #include "label-util.h"
 #include "log.h"
 #include "main-func.h"
@@ -24,6 +25,8 @@ static int run(int argc, char *argv[]) {
         _unused_ _cleanup_(notify_on_cleanup) const char *notify_stop = NULL;
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         r = service_parse_argv("systemd-resolved.service",
diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c
index 1eec7726ef..17f526b727 100644
--- a/src/shutdown/shutdown.c
+++ b/src/shutdown/shutdown.c
@@ -24,6 +24,7 @@
 #include "detach-loopback.h"
 #include "detach-md.h"
 #include "detach-swap.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "exec-util.h"
 #include "fd-util.h"
@@ -378,6 +379,8 @@ int main(int argc, char *argv[]) {
         size_t n_luo_fds = 0;
         int cmd, r;
 
+        LIBSELINUX_NOTE(recommended);
+
         /* LUO will preserve these across kexec */
         dual_timestamp_now(&shutdown_late_start);
 
diff --git a/src/socket-activate/socket-activate.c b/src/socket-activate/socket-activate.c
index be0179ccc9..fa60131ba9 100644
--- a/src/socket-activate/socket-activate.c
+++ b/src/socket-activate/socket-activate.c
@@ -9,6 +9,7 @@
 #include "alloc-util.h"
 #include "build.h"
 #include "daemon-util.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "errno-util.h"
 #include "escape.h"
@@ -468,6 +469,8 @@ static int run(int argc, char **argv) {
         _cleanup_strv_free_ char **exec_argv = NULL;
         int r, n;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         char **args = NULL;
diff --git a/src/ssh-generator/ssh-generator.c b/src/ssh-generator/ssh-generator.c
index 7d67d4178e..a5ae111043 100644
--- a/src/ssh-generator/ssh-generator.c
+++ b/src/ssh-generator/ssh-generator.c
@@ -4,6 +4,7 @@
 
 #include "alloc-util.h"
 #include "creds-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "fd-util.h"
 #include "fileio.h"
@@ -450,6 +451,9 @@ static int run(const char *dest, const char *dest_early, const char *dest_late)
 
         assert(dest);
 
+        LIBCRYPTO_NOTE(suggested);
+        TPM2_NOTE(suggested);
+
         r = proc_cmdline_parse(parse_proc_cmdline_item, /* userdata= */ NULL, /* flags= */ 0);
         if (r < 0)
                 log_warning_errno(r, "Failed to parse kernel command line, ignoring: %m");
diff --git a/src/sysext/sysext.c b/src/sysext/sysext.c
index c8c50279f5..3c308bd8b6 100644
--- a/src/sysext/sysext.c
+++ b/src/sysext/sysext.c
@@ -28,6 +28,7 @@
 #include "devnum-util.h"
 #include "discover-image.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "errno-util.h"
 #include "escape.h"
@@ -3175,6 +3176,9 @@ static int run(int argc, char *argv[]) {
         char **args = NULL;
         int r;
 
+        LIBCRYPTO_NOTE(suggested);
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         arg_image_class = invoked_as(argv, "systemd-confext") ? IMAGE_CONFEXT : IMAGE_SYSEXT;
diff --git a/src/sysinstall/sysinstall.c b/src/sysinstall/sysinstall.c
index e1346a5e26..82232f8ccb 100644
--- a/src/sysinstall/sysinstall.c
+++ b/src/sysinstall/sysinstall.c
@@ -15,6 +15,7 @@
 #include "chase.h"
 #include "conf-files.h"
 #include "constants.h"
+#include "dlopen-note.h"
 #include "efi-loader.h"
 #include "efivars.h"
 #include "env-file.h"
@@ -2068,6 +2069,11 @@ static void end_marker(void) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+
         setlocale(LC_ALL, "");
 
         r = parse_argv(argc, argv);
diff --git a/src/systemctl/systemctl-main.c b/src/systemctl/systemctl-main.c
index 8e2b1c170d..fea186d9cd 100644
--- a/src/systemctl/systemctl-main.c
+++ b/src/systemctl/systemctl-main.c
@@ -3,6 +3,7 @@
 #include <locale.h>
 
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "glyph-util.h"
 #include "log.h"
 #include "logs-show.h"
@@ -23,6 +24,13 @@ static int run(int argc, char *argv[]) {
         char **args = STRV_EMPTY;
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         setlocale(LC_ALL, "");
         log_setup();
 
diff --git a/src/sysupdate/sysupdate.c b/src/sysupdate/sysupdate.c
index 16aff0b681..fe39d31f6a 100644
--- a/src/sysupdate/sysupdate.c
+++ b/src/sysupdate/sysupdate.c
@@ -14,6 +14,7 @@
 #include "constants.h"
 #include "discover-image.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "errno-util.h"
 #include "fd-util.h"
@@ -2685,6 +2686,11 @@ static int vl_server(void) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+
         log_setup();
 
         char **args = NULL;
diff --git a/src/sysusers/sysusers.c b/src/sysusers/sysusers.c
index 48d256b15c..c32fb72d5e 100644
--- a/src/sysusers/sysusers.c
+++ b/src/sysusers/sysusers.c
@@ -11,6 +11,7 @@
 #include "copy.h"
 #include "creds-util.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "extract-word.h"
 #include "fd-util.h"
@@ -2269,6 +2270,14 @@ static int run(int argc, char *argv[]) {
         Item *i;
         int r;
 
+        LIBAUDIT_NOTE(recommended);
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPT_NOTE(recommended);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBCRYPTO_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         char **args = NULL;
         r = parse_argv(argc, argv, &args);
         if (r <= 0)
diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
index 5d20e6ca06..efc255d5e5 100644
--- a/src/timedate/timedated.c
+++ b/src/timedate/timedated.c
@@ -25,6 +25,7 @@
 #include "conf-files.h"
 #include "constants.h"
 #include "daemon-util.h"
+#include "dlopen-note.h"
 #include "extract-word.h"
 #include "fd-util.h"
 #include "fileio.h"
@@ -1164,6 +1165,8 @@ static int run(int argc, char *argv[]) {
         _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         r = service_parse_argv("systemd-timedated.service",
diff --git a/src/tmpfiles/tmpfiles.c b/src/tmpfiles/tmpfiles.c
index 261a4f0b92..0667b5b71f 100644
--- a/src/tmpfiles/tmpfiles.c
+++ b/src/tmpfiles/tmpfiles.c
@@ -25,6 +25,7 @@
 #include "devnum-util.h"
 #include "dirent-util.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "errno-util.h"
 #include "escape.h"
@@ -4853,6 +4854,12 @@ static int run(int argc, char *argv[]) {
         } phase;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBCRYPTO_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         char **args = NULL;
         r = parse_argv(argc, argv, &args);
         if (r <= 0)
diff --git a/src/tpm2-setup/tpm2-clear.c b/src/tpm2-setup/tpm2-clear.c
index 19186ecc02..fcef2b76bb 100644
--- a/src/tpm2-setup/tpm2-clear.c
+++ b/src/tpm2-setup/tpm2-clear.c
@@ -4,6 +4,7 @@
 
 #include "alloc-util.h"
 #include "build.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "fileio.h"
 #include "format-table.h"
@@ -110,6 +111,10 @@ static int request_tpm2_clear(void) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBTSS2_ESYS_NOTE(suggested);
+        LIBTSS2_MU_NOTE(suggested);
+        LIBTSS2_RC_NOTE(suggested);
+
         log_setup();
 
         r = parse_argv(argc, argv);
diff --git a/src/tpm2-setup/tpm2-generator.c b/src/tpm2-setup/tpm2-generator.c
index 5a4a88bf9f..7a826a0be1 100644
--- a/src/tpm2-setup/tpm2-generator.c
+++ b/src/tpm2-setup/tpm2-generator.c
@@ -2,6 +2,7 @@
 
 #include <unistd.h>
 
+#include "dlopen-note.h"
 #include "dropin.h"
 #include "efivars.h"
 #include "generator.h"
@@ -169,6 +170,10 @@ static int run(const char *dest, const char *dest_early, const char *dest_late)
 
         assert_se(arg_dest = dest);
 
+        LIBTSS2_ESYS_NOTE(suggested);
+        LIBTSS2_MU_NOTE(suggested);
+        LIBTSS2_RC_NOTE(suggested);
+
         r = proc_cmdline_parse(parse_proc_cmdline_item, NULL, PROC_CMDLINE_STRIP_RD_PREFIX);
         if (r < 0)
                 log_warning_errno(r, "Failed to parse kernel command line, ignoring: %m");
diff --git a/src/tpm2-setup/tpm2-setup.c b/src/tpm2-setup/tpm2-setup.c
index 897c4daf14..d655ab46d3 100644
--- a/src/tpm2-setup/tpm2-setup.c
+++ b/src/tpm2-setup/tpm2-setup.c
@@ -10,6 +10,7 @@
 #include "conf-files.h"
 #include "constants.h"
 #include "crypto-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "fd-util.h"
 #include "fileio.h"
@@ -599,6 +600,8 @@ static int run(int argc, char *argv[]) {
                 return EXIT_SUCCESS;
         }
 
+        LIBBLKID_NOTE(recommended);
+
         r = DLOPEN_LIBCRYPTO(LOG_ERR, required);
         if (r < 0)
                 return r;
diff --git a/src/tpm2-setup/tpm2-swtpm.c b/src/tpm2-setup/tpm2-swtpm.c
index 33d5defd06..a97c7c31be 100644
--- a/src/tpm2-setup/tpm2-swtpm.c
+++ b/src/tpm2-setup/tpm2-swtpm.c
@@ -6,6 +6,7 @@
 
 #include "alloc-util.h"
 #include "chase.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "escape.h"
 #include "fd-util.h"
@@ -145,6 +146,8 @@ static int setup_swtpm(const char *state_dir, int state_fd, const char *secret)
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBBLKID_NOTE(recommended);
+
         log_setup();
 
         _cleanup_free_ char *runtime_dir = NULL;
diff --git a/src/tty-ask-password-agent/tty-ask-password-agent.c b/src/tty-ask-password-agent/tty-ask-password-agent.c
index c7b1fb3e1f..d57ade56c9 100644
--- a/src/tty-ask-password-agent/tty-ask-password-agent.c
+++ b/src/tty-ask-password-agent/tty-ask-password-agent.c
@@ -19,6 +19,7 @@
 #include "daemon-util.h"
 #include "devnum-util.h"
 #include "dirent-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "exit-status.h"
 #include "fd-util.h"
@@ -700,6 +701,8 @@ static int ask_on_consoles(char *argv[]) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         umask(0022);
diff --git a/src/udev/udevadm.c b/src/udev/udevadm.c
index 9b7b09370a..341e00d118 100644
--- a/src/udev/udevadm.c
+++ b/src/udev/udevadm.c
@@ -3,6 +3,7 @@
 #include <stdio.h>
 
 #include "argv-util.h"
+#include "dlopen-note.h"
 #include "format-table.h"
 #include "help-util.h"
 #include "label-util.h"
@@ -101,6 +102,10 @@ static int run(int argc, char *argv[]) {
         char **args = NULL;
         int r;
 
+        LIBAPPARMOR_NOTE(recommended);
+        LIBAUDIT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         if (invoked_as(argv, "udevd"))
                 return run_udevd(argc, argv);
 
diff --git a/src/update-done/update-done.c b/src/update-done/update-done.c
index 67ce353e11..ceb8337495 100644
--- a/src/update-done/update-done.c
+++ b/src/update-done/update-done.c
@@ -5,6 +5,7 @@
 #include "alloc-util.h"
 #include "build.h"
 #include "chase.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "fd-util.h"
 #include "fileio.h"
@@ -124,6 +125,8 @@ static int run(int argc, char *argv[]) {
         struct stat st;
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         r = parse_argv(argc, argv);
         if (r <= 0)
                 return r;
diff --git a/src/update-utmp/update-utmp.c b/src/update-utmp/update-utmp.c
index d27616c2cd..3ae949f114 100644
--- a/src/update-utmp/update-utmp.c
+++ b/src/update-utmp/update-utmp.c
@@ -7,6 +7,7 @@
 #include "bus-error.h"
 #include "bus-locator.h"
 #include "bus-util.h"
+#include "dlopen-note.h"
 #include "libaudit-util.h"
 #include "log.h"
 #include "main-func.h"
@@ -109,6 +110,8 @@ static int run(int argc, char *argv[]) {
                 .audit_fd = -EBADF,
         };
 
+        LIBAUDIT_NOTE(recommended);
+
         log_setup();
 
         umask(0022);
diff --git a/src/user-sessions/user-sessions.c b/src/user-sessions/user-sessions.c
index faf37602af..f9717b88cc 100644
--- a/src/user-sessions/user-sessions.c
+++ b/src/user-sessions/user-sessions.c
@@ -2,6 +2,7 @@
 
 #include <sys/stat.h>
 
+#include "dlopen-note.h"
 #include "fs-util.h"
 #include "label-util.h"
 #include "log.h"
@@ -12,6 +13,8 @@
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         if (argc != 2)
                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
                                        "This program requires one argument.");
diff --git a/src/userdb/userdbctl.c b/src/userdb/userdbctl.c
index fd349b2826..e4fd5a9e8d 100644
--- a/src/userdb/userdbctl.c
+++ b/src/userdb/userdbctl.c
@@ -10,6 +10,7 @@
 #include "copy.h"
 #include "creds-util.h"
 #include "dirent-util.h"
+#include "dlopen-note.h"
 #include "errno-list.h"
 #include "errno-util.h"
 #include "escape.h"
@@ -1853,6 +1854,8 @@ static int run(int argc, char *argv[]) {
         _cleanup_strv_free_ char **args = NULL;
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         r = parse_argv(argc, argv, &args);
diff --git a/src/veritysetup/veritysetup.c b/src/veritysetup/veritysetup.c
index dde1910866..56c199dbd7 100644
--- a/src/veritysetup/veritysetup.c
+++ b/src/veritysetup/veritysetup.c
@@ -8,6 +8,7 @@
 #include "alloc-util.h"
 #include "argv-util.h"
 #include "cryptsetup-util.h"
+#include "dlopen-note.h"
 #include "extract-word.h"
 #include "fileio.h"
 #include "format-table.h"
@@ -493,6 +494,8 @@ static int run(int argc, char *argv[]) {
 
         log_setup();
 
+        LIBCRYPTO_NOTE(suggested);
+
         r = DLOPEN_CRYPTSETUP(LOG_ERR, required);
         if (r < 0)
                 return r;
diff --git a/src/vmspawn/vmspawn.c b/src/vmspawn/vmspawn.c
index 2a3ee83512..460219c144 100644
--- a/src/vmspawn/vmspawn.c
+++ b/src/vmspawn/vmspawn.c
@@ -29,6 +29,7 @@
 #include "copy.h"
 #include "discover-image.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "escape.h"
 #include "ether-addr-util.h"
 #include "event-util.h"
@@ -4286,6 +4287,9 @@ static int run(int argc, char *argv[]) {
         int r, kvm_device_fd = -EBADF, vhost_device_fd = -EBADF;
         _cleanup_strv_free_ char **names = NULL;
 
+        LIBBLKID_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         arg_runtime_scope = getuid() == 0 ? RUNTIME_SCOPE_SYSTEM : RUNTIME_SCOPE_USER;
diff --git a/src/volatile-root/volatile-root.c b/src/volatile-root/volatile-root.c
index 883f193ff4..9e337958ab 100644
--- a/src/volatile-root/volatile-root.c
+++ b/src/volatile-root/volatile-root.c
@@ -7,6 +7,7 @@
 #include "blockdev-util.h"
 #include "chase.h"
 #include "devnum-util.h"
+#include "dlopen-note.h"
 #include "escape.h"
 #include "log.h"
 #include "main-func.h"
@@ -122,6 +123,8 @@ static int run(int argc, char *argv[]) {
         dev_t devt;
         int r;
 
+        LIBMOUNT_NOTE(recommended);
+
         log_setup();
 
         if (argc > 3)