diff --git a/src/basic/terminal-util.c b/src/basic/terminal-util.c
index 50ad4c89af..498e2d532b 100644
--- a/src/basic/terminal-util.c
+++ b/src/basic/terminal-util.c
@@ -1156,10 +1156,12 @@ int resolve_dev_console(char **ret) {
                 tty = active;
         }
 
-        if (tty != active)
-                return strdup_to(ret, tty);
+        _cleanup_free_ char *path = NULL;
+        path = path_join("/dev", tty);
+        if (!path)
+                return -ENOMEM;
 
-        *ret = TAKE_PTR(active);
+        *ret = TAKE_PTR(path);
         return 0;
 }
 
@@ -1231,9 +1233,7 @@ bool tty_is_vc_resolve(const char *tty) {
 
         assert(tty);
 
-        tty = skip_dev_prefix(tty);
-
-        if (streq(tty, "console")) {
+        if (streq(skip_dev_prefix(tty), "console")) {
                 if (resolve_dev_console(&resolved) < 0)
                         return false;
 
diff --git a/src/core/exec-invoke.c b/src/core/exec-invoke.c
index d9878e6088..ef501607b6 100644
--- a/src/core/exec-invoke.c
+++ b/src/core/exec-invoke.c
@@ -369,10 +369,21 @@ static int setup_input(
         case EXEC_INPUT_TTY_FORCE:
         case EXEC_INPUT_TTY_FAIL: {
                 _cleanup_close_ int tty_fd = -EBADF;
+                _cleanup_free_ char *resolved = NULL;
                 const char *tty_path;
 
                 tty_path = ASSERT_PTR(exec_context_tty_path(context));
 
+                if (tty_is_console(tty_path)) {
+                        r = resolve_dev_console(&resolved);
+                        if (r < 0)
+                                log_debug_errno(r, "Failed to resolve /dev/console, ignoring: %m");
+                        else {
+                                log_debug("Resolved /dev/console to %s", resolved);
+                                tty_path = resolved;
+                        }
+                }
+
                 tty_fd = acquire_terminal(tty_path,
                                           i == EXEC_INPUT_TTY_FAIL  ? ACQUIRE_TERMINAL_TRY :
                                           i == EXEC_INPUT_TTY_FORCE ? ACQUIRE_TERMINAL_FORCE :
@@ -1190,6 +1201,7 @@ static int setup_pam(
 
         _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
         _cleanup_strv_free_ char **e = NULL;
+        _cleanup_free_ char *tty = NULL;
         pam_handle_t *handle = NULL;
         sigset_t old_ss;
         int pam_code = PAM_SUCCESS, r;
@@ -1225,15 +1237,14 @@ static int setup_pam(
                 goto fail;
         }
 
-        const char *tty = context->tty_path;
-        if (!tty) {
-                _cleanup_free_ char *q = NULL;
+        if (getttyname_malloc(STDIN_FILENO, &tty) >= 0) {
+                _cleanup_free_ char *q = path_join("/dev", tty);
+                if (!q) {
+                        r = -ENOMEM;
+                        goto fail;
+                }
 
-                /* Hmm, so no TTY was explicitly passed, but an fd passed to us directly might be a TTY. Let's figure
-                 * out if that's the case, and read the TTY off it. */
-
-                if (getttyname_malloc(STDIN_FILENO, &q) >= 0)
-                        tty = strjoina("/dev/", q);
+                free_and_replace(tty, q);
         }
 
         if (tty) {
diff --git a/src/core/execute.c b/src/core/execute.c
index e5ae2ee7a1..b789a1b454 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -967,7 +967,7 @@ static bool tty_may_match_dev_console(const char *tty) {
                 return true; /* if we could not resolve, assume it may */
 
         /* "tty0" means the active VC, so it may be the same sometimes */
-        return path_equal(resolved, tty) || (streq(resolved, "tty0") && tty_is_vc(tty));
+        return path_equal(skip_dev_prefix(resolved), tty) || (streq(skip_dev_prefix(resolved), "tty0") && tty_is_vc(tty));
 }
 
 static bool exec_context_may_touch_tty(const ExecContext *ec) {