diff --git a/man/systemd-sysctl.service.xml b/man/systemd-sysctl.service.xml
index a817a6b33f..82b2ec71bb 100644
--- a/man/systemd-sysctl.service.xml
+++ b/man/systemd-sysctl.service.xml
@@ -105,11 +105,36 @@
       <varlistentry>
         <term><option>--inline</option></term>
         <listitem><para>Treat each positional argument as a separate configuration line instead of a file
-        name.</para>
+        name. When specified, at least one positional argument must be specified.</para>
 
         <xi:include href="version-info.xml" xpointer="v259"/></listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><option>--save=<replaceable>FILENAME</replaceable></option></term>
+        <listitem>
+          <para>Before applying the loaded sysctl settings, write them to <filename>/run/sysctl.d/</filename>
+          using the specified filename. If the filename does not end with <filename>.conf</filename>, the
+          suffix is appended. This option requires one or more positional arguments. May be combined with
+          <option>--inline</option>. This may be useful for creating runtime sysctl configuration files or
+          overriding existing sysctl configuration files.</para>
+
+          <xi:include href="version-info.xml" xpointer="v262"/>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>--revert=<replaceable>FILENAME</replaceable></option></term>
+        <listitem>
+          <para>Before loading and applying the sysctl settings, removes the specified sysctl configuration
+          file under <filename>/run/sysctl.d/</filename>. If the filename does not end with
+          <filename>.conf</filename>, the suffix is appended. This may be useful for removing configuration
+          files created by <option>--save=</option>.</para>
+
+          <xi:include href="version-info.xml" xpointer="v262"/>
+        </listitem>
+      </varlistentry>
+
       <xi:include href="standard-options.xml" xpointer="cat-config" />
       <xi:include href="standard-options.xml" xpointer="tldr" />
       <xi:include href="standard-options.xml" xpointer="no-pager" />
@@ -186,6 +211,26 @@ kernel.core_pattern = |/usr/libexec/abrt-hook-ccpp %s %c %p %u %g %t %P %I
       of preference.</para>
     </example>
 
+    <example>
+      <title>Disable IPv6 on an interface and save the specified setting</title>
+
+      <programlisting># /usr/lib/systemd/systemd-sysctl --save=99-disable-ipv6-foo - &lt;&lt;EOF
+net.ipv6.conf.foo.disable_ipv6=1
+EOF</programlisting>
+
+      <para>This disables IPv6 on the network interface <filename>foo</filename>, and creates
+      <filename>/run/sysctl.d/99-disable-ipv6-foo.conf</filename>.</para>
+    </example>
+
+    <example>
+      <title>Remove a runtime sysctl configuration file</title>
+
+      <programlisting># /usr/lib/systemd/systemd-sysctl --revert=99-disable-ipv6-foo --prefix=/net/ipv6/conf/foo</programlisting>
+
+      <para>This removes <filename>/run/sysctl.d/99-disable-ipv6-foo.conf</filename>, and applies the
+      remaining sysctl settings for the network interface <filename>foo</filename>.</para>
+    </example>
+
     <para>See
     <citerefentry project='man-pages'><refentrytitle>sysctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>
     for various ways to directly apply sysctl settings.</para>
diff --git a/src/sysctl/sysctl.c b/src/sysctl/sysctl.c
index fa95932985..1e94643cad 100644
--- a/src/sysctl/sysctl.c
+++ b/src/sysctl/sysctl.c
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include <sys/stat.h>
+#include <unistd.h>
 
 #include "sd-json.h"
 
@@ -10,16 +11,20 @@
 #include "constants.h"
 #include "creds-util.h"
 #include "errno-util.h"
+#include "fs-util.h"
 #include "glob-util.h"
 #include "hashmap.h"
 #include "log.h"
 #include "main-func.h"
+#include "mkdir.h"
+#include "options.h"
 #include "pager.h"
 #include "path-util.h"
 #include "pretty-print.h"
 #include "string-util.h"
 #include "strv.h"
 #include "sysctl-util.h"
+#include "tmpfile-util.h"
 #include "verbs.h"
 
 static char **arg_prefixes = NULL;
@@ -28,8 +33,12 @@ static bool arg_strict = false;
 static bool arg_verify = false;
 static bool arg_inline = false;
 static PagerFlags arg_pager_flags = 0;
+static char *arg_save_file = NULL;
+static char *arg_revert_file = NULL;
 
 STATIC_DESTRUCTOR_REGISTER(arg_prefixes, strv_freep);
+STATIC_DESTRUCTOR_REGISTER(arg_save_file, freep);
+STATIC_DESTRUCTOR_REGISTER(arg_revert_file, freep);
 
 COMMAND(
         "systemd-sysctl\0",
@@ -226,6 +235,13 @@ static int apply_all(OrderedHashmap *sysctl_options) {
         return r;
 }
 
+static void filter_sysctl_options(OrderedHashmap *sysctl_options) {
+        SysctlOption *option;
+        ORDERED_HASHMAP_FOREACH(option, sysctl_options)
+                if (!string_is_glob(option->key) && !test_prefix(option->key))
+                        sysctl_option_free(ordered_hashmap_remove(sysctl_options, option->key));
+}
+
 static int parse_line(const char *fname, unsigned line, const char *buffer, bool *invalid_config, void *userdata) {
         OrderedHashmap **sysctl_options = ASSERT_PTR(userdata);
         _cleanup_free_ char *k = NULL, *v = NULL;
@@ -262,9 +278,19 @@ static int parse_line(const char *fname, unsigned line, const char *buffer, bool
 
         const char *key = sysctl_normalize(strstrip(k)), *value = strstrip(v);
 
-        /* We can't filter out globs at this point, we'll need to do that later. */
-        if (!string_is_glob(key) && !test_prefix(key))
-                return 0;
+        if (arg_save_file) {
+                /* When saving the loaded rules, refuse unsafe characters, especially newlines, in keys
+                 * and values. Otherwise, the saved file may not be parsed correctly. */
+                if (!string_is_safe(key, STRING_ALLOW_BACKSLASHES | STRING_ALLOW_QUOTES | STRING_ALLOW_GLOBS) ||
+                    (value && !string_is_safe(value, STRING_ALLOW_EMPTY | STRING_ALLOW_BACKSLASHES | STRING_ALLOW_QUOTES | STRING_ALLOW_GLOBS)))
+                        return log_syntax(NULL, LOG_WARNING, fname, line, SYNTHETIC_ERRNO(EINVAL),
+                                          "Ignoring unsafe key and/or value for '%s'.", key);
+        } else {
+                /* We can't filter out globs at this point, we'll need to do that later.
+                 * Keep them when saving the loaded rules, and filter them after writing. */
+                if (!string_is_glob(key) && !test_prefix(key))
+                        return 0;
+        }
 
         SysctlOption *existing = ordered_hashmap_get(*sysctl_options, key);
         if (existing) {
@@ -325,7 +351,82 @@ static int cat_config(char **files) {
         return cat_files(NULL, files, arg_cat_flags);
 }
 
+static int save_sysctl_options(OrderedHashmap *sysctl_options, const char *filename) {
+        int r;
+
+        assert(filename);
+
+        if (ordered_hashmap_isempty(sysctl_options)) {
+                log_info("No sysctl settings loaded, not creating '%s'.", filename);
+                return 0;
+        }
+
+        r = mkdir_p("/run/sysctl.d/", 0755);
+        if (r < 0)
+                return log_error_errno(r, "Failed to create directory '/run/sysctl.d/': %m");
+
+        _cleanup_free_ char *path = path_join("/run/sysctl.d/", filename);
+        if (!path)
+                return log_oom();
+
+        _cleanup_fclose_ FILE *f = NULL;
+        _cleanup_(unlink_and_freep) char *temp_path = NULL;
+        r = fopen_temporary(path, &f, &temp_path);
+        if (r < 0)
+                return log_error_errno(r, "Failed to open a temporary file for '%s': %m", path);
+
+        if (fchmod(fileno(f), 0644) < 0)
+                return log_error_errno(errno, "Failed to chmod '%s': %m", temp_path);
+
+        fputs("# This is generated by systemd-sysctl.\n", f);
+
+        SysctlOption *option;
+        ORDERED_HASHMAP_FOREACH(option, sysctl_options)
+                fprintf(f, "%s%s%s%s\n",
+                        option->ignore_failure || !option->value ? "-" : "",
+                        option->key,
+                        option->value ? " = " : "",
+                        strempty(option->value));
+
+        r = fflush_and_check(f);
+        if (r < 0)
+                return log_error_errno(r, "Failed to flush '%s': %m", temp_path);
+
+        r = conservative_rename(temp_path, path);
+        if (r < 0)
+                return log_error_errno(r, "Failed to rename '%s' to '%s': %m", temp_path, path);
+
+        temp_path = mfree(temp_path);
+        return 0;
+}
+
+static int parse_conf_filename(const char *src, const char *option, char **dest) {
+        assert(option);
+        assert(dest);
+
+        if (isempty(src))
+                return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot use an empty filename for %s.", option);
+
+        if (startswith(src, "."))
+                return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Dot-prefixed filenames are not allowed for %s.", option);
+
+        _cleanup_free_ char *name = NULL;
+        if (!endswith(src, ".conf"))
+                name = strjoin(src, ".conf");
+        else
+                name = strdup(src);
+        if (!name)
+                return log_oom();
+
+        if (!filename_is_valid(name))
+                return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid file name '%s' specified for %s.", name, option);
+
+        return free_and_replace(*dest, name);
+}
+
 static int parse_argv(int argc, char *argv[], char ***remaining_args) {
+        int r;
+
         assert(argc >= 0);
         assert(argv);
         assert(remaining_args);
@@ -391,6 +492,20 @@ static int parse_argv(int argc, char *argv[], char ***remaining_args) {
                         arg_inline = true;
                         break;
 
+                OPTION_LONG("save", "FILENAME",
+                            "Write loaded settings to the specified file"):
+                        r = parse_conf_filename(opts.arg, "--save=", &arg_save_file);
+                        if (r < 0)
+                                return r;
+                        break;
+
+                OPTION_LONG("revert", "FILENAME",
+                            "Remove the specified file from /run/sysctl.d/"):
+                        r = parse_conf_filename(opts.arg, "--revert=", &arg_revert_file);
+                        if (r < 0)
+                                return r;
+                        break;
+
                 OPTION_COMMON_INTROSPECT_CLI:
                         return introspect_cli(SD_JSON_FORMAT_OFF);
                 }
@@ -401,6 +516,14 @@ static int parse_argv(int argc, char *argv[], char ***remaining_args) {
                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
                                        "Positional arguments are not allowed with --cat-config/--tldr.");
 
+        if (arg_inline && strv_isempty(*remaining_args))
+                return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
+                                       "--inline requires positional arguments.");
+
+        if (arg_save_file && strv_isempty(*remaining_args))
+                return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
+                                       "--save= requires positional arguments.");
+
         return 1;
 }
 
@@ -416,17 +539,40 @@ static int run(int argc, char *argv[]) {
 
         umask(0022);
 
+        if (arg_revert_file) {
+                _cleanup_free_ char *path = path_join("/run/sysctl.d/", arg_revert_file);
+                if (!path)
+                        return log_oom();
+
+                if (unlink(path) < 0 && errno != ENOENT)
+                        return log_error_errno(errno, "Failed to remove '%s': %m", path);
+        }
+
         _cleanup_ordered_hashmap_free_ OrderedHashmap *sysctl_options = NULL;
         if (!strv_isempty(args)) {
                 unsigned pos = 0;
 
                 STRV_FOREACH(arg, args) {
-                        if (arg_inline)
+                        if (arg_inline) {
+                                pos++;
+
+                                const char *s = skip_leading_chars(*arg, /* bad= */ NULL);
+                                if (IN_SET(*s, '\0', '#'))
+                                        continue;
+
                                 /* Use (argument):n, where n==1 for the first positional arg */
-                                RET_GATHER(r, parse_line("(argument)", ++pos, *arg, /* invalid_config= */ NULL, &sysctl_options));
-                        else
+                                RET_GATHER(r, parse_line("(argument)", pos, s, /* invalid_config= */ NULL, &sysctl_options));
+                        } else
                                 RET_GATHER(r, parse_file(&sysctl_options, *arg, false));
                 }
+
+                if (arg_save_file) {
+                        r = save_sysctl_options(sysctl_options, arg_save_file);
+                        if (r < 0)
+                                return r;
+
+                        filter_sysctl_options(sysctl_options);
+                }
         } else {
                 _cleanup_strv_free_ char **files = NULL;
 
diff --git a/test/units/TEST-87-AUX-UTILS-VM.sysctl.sh b/test/units/TEST-87-AUX-UTILS-VM.sysctl.sh
index 9385c05a47..f19a0ba774 100755
--- a/test/units/TEST-87-AUX-UTILS-VM.sysctl.sh
+++ b/test/units/TEST-87-AUX-UTILS-VM.sysctl.sh
@@ -16,7 +16,8 @@ echo "-foo.foo=42" >/tmp/foo.conf
 assert_rc 0 /usr/lib/systemd/systemd-sysctl /tmp/foo.conf
 assert_rc 0 /usr/lib/systemd/systemd-sysctl --strict /tmp/foo.conf
 
-assert_rc 0 /usr/lib/systemd/systemd-sysctl --inline "foo.bar=42"
+assert_rc 1 /usr/lib/systemd/systemd-sysctl --inline
+assert_rc 0 /usr/lib/systemd/systemd-sysctl --inline "   foo.bar=42" "#comment" "   "
 assert_rc 1 /usr/lib/systemd/systemd-sysctl --inline --strict "foo.bar=42"
 assert_rc 0 /usr/lib/systemd/systemd-sysctl --inline -- "-foo.bar=42"
 assert_rc 0 /usr/lib/systemd/systemd-sysctl --inline --strict -- "-foo.bar=42"
@@ -91,3 +92,134 @@ EOF
 assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp)" "1"
 assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/bootp_relay)" "1"
 assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/disable_policy)" "0"
+
+##########################
+# --save= and --revert=
+##########################
+(! /usr/lib/systemd/systemd-sysctl --save=)
+(! /usr/lib/systemd/systemd-sysctl --save=.)
+(! /usr/lib/systemd/systemd-sysctl --save=.conf)
+(! /usr/lib/systemd/systemd-sysctl --save=aaa/hoge.conf)
+(! /usr/lib/systemd/systemd-sysctl --save=../hoge.conf)
+(! /usr/lib/systemd/systemd-sysctl --revert=)
+(! /usr/lib/systemd/systemd-sysctl --revert=.)
+(! /usr/lib/systemd/systemd-sysctl --revert=.conf)
+(! /usr/lib/systemd/systemd-sysctl --revert=aaa/hoge.conf)
+(! /usr/lib/systemd/systemd-sysctl --revert=../hoge.conf)
+
+# --save= requires positional arguments
+(! /usr/lib/systemd/systemd-sysctl --save=foo)
+
+# Do not create an empty conf file.
+/usr/lib/systemd/systemd-sysctl \
+    --prefix=/net/ipv4/conf/hoge --save=foo --inline "# comment only"
+[[ ! -e /run/sysctl.d/foo.conf ]]
+
+echo 0 >/proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp
+echo 0 >/proc/sys/net/ipv4/conf/hoge/bootp_relay
+echo 0 >/proc/sys/net/ipv4/conf/hoge/disable_policy
+
+/usr/lib/systemd/systemd-sysctl \
+    --prefix=/net/ipv4/conf/hoge --save=foo --inline -- \
+    '# This argument should be ignored' \
+    'net.ipv4.conf.*.drop_gratuitous_arp=1' \
+    'net.ipv4.*.*.bootp_relay=1' \
+    '-net.ipv4.conf.all.bootp_relay' \
+    '-net.ipv4.aaa.*.disable_policy=1' \
+    '# Arguments with unsafe characters should be ignored' \
+    $'foo\nbar.hoge=1' \
+    $'foo.bar=4\n2'
+
+assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp)" "1"
+assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/bootp_relay)" "1"
+assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/disable_policy)" "0"
+
+diff /run/sysctl.d/foo.conf - <<EOF
+# This is generated by systemd-sysctl.
+net/ipv4/conf/*/drop_gratuitous_arp = 1
+net/ipv4/*/*/bootp_relay = 1
+-net/ipv4/conf/all/bootp_relay
+-net/ipv4/aaa/*/disable_policy = 1
+EOF
+
+echo 0 >/proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp
+echo 0 >/proc/sys/net/ipv4/conf/hoge/bootp_relay
+echo 0 >/proc/sys/net/ipv4/conf/hoge/disable_policy
+
+/usr/lib/systemd/systemd-sysctl --prefix=/net/ipv4/conf/hoge --save=foo - <<EOF
+# This line should be ignored
+net.ipv4.conf.*.drop_gratuitous_arp=1
+net.ipv4.*.*.bootp_relay=1
+-net.ipv4.conf.all.bootp_relay
+-net.ipv4.aaa.*.disable_policy=1
+foo.bar=42
+EOF
+
+assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp)" "1"
+assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/bootp_relay)" "1"
+assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/disable_policy)" "0"
+
+diff /run/sysctl.d/foo.conf - <<EOF
+# This is generated by systemd-sysctl.
+net/ipv4/conf/*/drop_gratuitous_arp = 1
+net/ipv4/*/*/bootp_relay = 1
+-net/ipv4/conf/all/bootp_relay
+-net/ipv4/aaa/*/disable_policy = 1
+foo/bar = 42
+EOF
+
+echo 0 >/proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp
+echo 0 >/proc/sys/net/ipv4/conf/hoge/bootp_relay
+echo 0 >/proc/sys/net/ipv4/conf/hoge/disable_policy
+
+# Verify that the saved .conf file is loaded.
+/usr/lib/systemd/systemd-sysctl --prefix=/net/ipv4/conf/hoge
+assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp)" "1"
+assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/bootp_relay)" "1"
+assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/disable_policy)" "0"
+
+echo 0 >/proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp
+echo 0 >/proc/sys/net/ipv4/conf/hoge/bootp_relay
+echo 0 >/proc/sys/net/ipv4/conf/hoge/disable_policy
+
+# Check that the saved .conf file can be overridden.
+/usr/lib/systemd/systemd-sysctl --prefix=/net/ipv4/conf/hoge --save=foo /run/sysctl.d/foo.conf - <<EOF
+net.ipv4.conf.*.drop_gratuitous_arp=0
+net.ipv4.conf.hoge.disable_policy=1
+EOF
+assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp)" "0"
+assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/bootp_relay)" "1"
+assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/disable_policy)" "1"
+
+diff /run/sysctl.d/foo.conf - <<EOF
+# This is generated by systemd-sysctl.
+net/ipv4/*/*/bootp_relay = 1
+-net/ipv4/conf/all/bootp_relay
+-net/ipv4/aaa/*/disable_policy = 1
+foo/bar = 42
+net/ipv4/conf/*/drop_gratuitous_arp = 0
+net/ipv4/conf/hoge/disable_policy = 1
+EOF
+
+echo 0 >/proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp
+echo 0 >/proc/sys/net/ipv4/conf/hoge/bootp_relay
+echo 0 >/proc/sys/net/ipv4/conf/hoge/disable_policy
+
+/usr/lib/systemd/systemd-sysctl --revert=foo --prefix=/net/ipv4/conf/hoge
+[[ ! -e /run/sysctl.d/foo.conf ]]
+
+# Assume that no saved sysctl .conf files modify these variables.
+assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp)" "0"
+assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/bootp_relay)" "0"
+assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/disable_policy)" "0"
+
+echo 0 >/proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp
+echo 0 >/proc/sys/net/ipv4/conf/hoge/bootp_relay
+echo 0 >/proc/sys/net/ipv4/conf/hoge/disable_policy
+
+# Try again to test when foo.conf does not exist
+/usr/lib/systemd/systemd-sysctl --revert=foo --prefix=/net/ipv4/conf/hoge
+
+assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp)" "0"
+assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/bootp_relay)" "0"
+assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/disable_policy)" "0"