diff --git a/src/shared/base-filesystem.c b/src/shared/base-filesystem.c
index 5890f30383..f2161041c8 100644
--- a/src/shared/base-filesystem.c
+++ b/src/shared/base-filesystem.c
@@ -36,9 +36,9 @@ static const BaseFilesystem table[] = {
         { "usr",   0755, NULL,                         NULL },
         { "var",   0755, NULL,                         NULL },
         { "etc",   0755, NULL,                         NULL },
-        { "proc",  0755, NULL,                         NULL, true },
-        { "sys",   0755, NULL,                         NULL, true },
-        { "dev",   0755, NULL,                         NULL, true },
+        { "proc",  0555, NULL,                         NULL, true },
+        { "sys",   0555, NULL,                         NULL, true },
+        { "dev",   0555, NULL,                         NULL, true },
 
         /* Various architecture ABIs define the path to the dynamic loader via the /lib64/ subdirectory of
          * the root directory. When booting from an otherwise empty root file system (where only /usr/ has
diff --git a/src/shared/mount-setup.c b/src/shared/mount-setup.c
index 1303b6c71b..a920e8a92a 100644
--- a/src/shared/mount-setup.c
+++ b/src/shared/mount-setup.c
@@ -115,12 +115,10 @@ static const MountPoint mount_table[] = {
 };
 
 bool mount_point_is_api(const char *path) {
-        unsigned i;
-
         /* Checks if this mount point is considered "API", and hence
          * should be ignored */
 
-        for (i = 0; i < ELEMENTSOF(mount_table); i ++)
+        for (size_t i = 0; i < ELEMENTSOF(mount_table); i ++)
                 if (path_equal(path, mount_table[i].where))
                         return true;