diff --git a/src/core/bpf-restrict-ifaces.c b/src/core/bpf-restrict-ifaces.c
index 64d8d1a7e5..a39f4895f2 100644
--- a/src/core/bpf-restrict-ifaces.c
+++ b/src/core/bpf-restrict-ifaces.c
@@ -128,7 +128,7 @@ static int restrict_ifaces_install_impl(Unit *u) {
         if (r < 0)
                 return r;
 
-        cgroup_fd = open(cgroup_path, O_RDONLY | O_CLOEXEC | O_DIRECTORY, 0);
+        cgroup_fd = open(cgroup_path, O_PATH | O_CLOEXEC | O_DIRECTORY, 0);
         if (cgroup_fd < 0)
                 return -errno;
 
diff --git a/src/core/cgroup.c b/src/core/cgroup.c
index e9eb6f96e8..50dd3dd45d 100644
--- a/src/core/cgroup.c
+++ b/src/core/cgroup.c
@@ -4266,7 +4266,7 @@ int manager_setup_cgroup(Manager *m) {
 
                 /* 6. And pin it, so that it cannot be unmounted */
                 safe_close(m->pin_cgroupfs_fd);
-                m->pin_cgroupfs_fd = open(path, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOCTTY|O_NONBLOCK);
+                m->pin_cgroupfs_fd = open(path, O_PATH|O_CLOEXEC|O_DIRECTORY);
                 if (m->pin_cgroupfs_fd < 0)
                         return log_error_errno(errno, "Failed to open pin file: %m");
 
diff --git a/src/home/homed-home.c b/src/home/homed-home.c
index da64d1a8b6..664397e55e 100644
--- a/src/home/homed-home.c
+++ b/src/home/homed-home.c
@@ -386,7 +386,7 @@ static void home_pin(Home *h) {
                 return;
         }
 
-        h->pin_fd = open(path, O_RDONLY|O_DIRECTORY|O_CLOEXEC);
+        h->pin_fd = open(path, O_PATH|O_DIRECTORY|O_CLOEXEC);
         if (h->pin_fd < 0) {
                 log_warning_errno(errno, "Couldn't open home directory '%s' for pinning, ignoring: %m", path);
                 return;
diff --git a/src/home/homework-blob.c b/src/home/homework-blob.c
index 6b22ab6f24..0ad2941539 100644
--- a/src/home/homework-blob.c
+++ b/src/home/homework-blob.c
@@ -218,7 +218,7 @@ int home_reconcile_blob_dirs(UserRecord *h, int root_fd, int reconciled) {
         if (reconciled == USER_RECONCILE_IDENTICAL)
                 return 0;
 
-        sys_base_dfd = open(home_system_blob_dir(), O_RDONLY|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW);
+        sys_base_dfd = open(home_system_blob_dir(), O_PATH|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW);
         if (sys_base_dfd < 0)
                 return log_error_errno(errno, "Failed to open system blob dir: %m");
 
diff --git a/src/shared/switch-root.c b/src/shared/switch-root.c
index e64b6f6c8f..621161a1c0 100644
--- a/src/shared/switch-root.c
+++ b/src/shared/switch-root.c
@@ -58,7 +58,7 @@ int switch_root(const char *new_root,
         if (old_root_fd < 0)
                 return log_error_errno(errno, "Failed to open root directory: %m");
 
-        new_root_fd = open(new_root, O_DIRECTORY|O_CLOEXEC);
+        new_root_fd = open(new_root, O_PATH|O_DIRECTORY|O_CLOEXEC);
         if (new_root_fd < 0)
                 return log_error_errno(errno, "Failed to open target directory '%s': %m", new_root);