diff --git a/src/cryptenroll/cryptenroll-tpm2.c b/src/cryptenroll/cryptenroll-tpm2.c
index 583259d853..db83ddc6e5 100644
--- a/src/cryptenroll/cryptenroll-tpm2.c
+++ b/src/cryptenroll/cryptenroll-tpm2.c
@@ -26,7 +26,7 @@ static int search_policy_hash(
         assert(iovec_is_valid(hash));
 
         if (!iovec_is_set(hash))
-                return 0;
+                return -ENOENT;
 
         for (int token = 0; token < sym_crypt_token_max(CRYPT_LUKS2); token++) {
                 _cleanup_(sd_json_variant_unrefp) sd_json_variant *v = NULL;
@@ -443,7 +443,7 @@ int enroll_tpm2(struct crypt_device *cd,
                 slot_to_wipe = r;
         } else {
                 log_info("This PCR set is already enrolled, executing no operation.");
-                *ret_slot_to_wipe = slot_to_wipe;
+                *ret_slot_to_wipe = -1;
                 return r; /* return existing keyslot, so that wiping won't kill it */
         }
 
diff --git a/src/cryptenroll/cryptenroll.c b/src/cryptenroll/cryptenroll.c
index df67a5636c..ad98acb762 100644
--- a/src/cryptenroll/cryptenroll.c
+++ b/src/cryptenroll/cryptenroll.c
@@ -885,6 +885,8 @@ static int run(int argc, char *argv[]) {
                 slot = enroll_tpm2(cd, &vk, arg_tpm2_device, arg_tpm2_seal_key_handle, arg_tpm2_device_key, arg_tpm2_hash_pcr_values, arg_tpm2_n_hash_pcr_values, arg_tpm2_public_key, arg_tpm2_load_public_key, arg_tpm2_public_key_pcr_mask, arg_tpm2_signature, arg_tpm2_pin, arg_tpm2_pcrlock, &slot_to_wipe);
 
                 if (slot >= 0 && slot_to_wipe >= 0) {
+                        assert(slot != slot_to_wipe);
+
                         /* Updating PIN on an existing enrollment */
                         r = wipe_slots(
                                         cd,
diff --git a/src/test/test-tpm2.c b/src/test/test-tpm2.c
index 3b5a375c88..2be104d853 100644
--- a/src/test/test-tpm2.c
+++ b/src/test/test-tpm2.c
@@ -1179,7 +1179,7 @@ static int check_calculate_seal(Tpm2Context *c) {
         int r;
 
         if (detect_virtualization() == VIRTUALIZATION_NONE && !slow_tests_enabled()) {
-                log_notice("Skipping slow calculate seal TPM2 tests. Physical system detected, and slow tests disabled.");
+                log_notice("Skipping slow calculate seal TPM2 tests. Physical system detected, and slow tests disabled. (To enable, run again with $SYSTEMD_SLOW_TESTS=1.)");
                 return 0;
         }
 
@@ -1257,7 +1257,7 @@ static void check_seal_unseal(Tpm2Context *c) {
         assert(c);
 
         if (detect_virtualization() == VIRTUALIZATION_NONE && !slow_tests_enabled()) {
-                log_notice("Skipping slow seal/unseal TPM2 tests. Physical system detected, and slow tests disabled.");
+                log_notice("Skipping slow seal/unseal TPM2 tests. Physical system detected, and slow tests disabled. (To enable, run again with $SYSTEMD_SLOW_TESTS=1.)");
                 return;
         }