diff --git a/src/network/netdev/l2tp-tunnel.c b/src/network/netdev/l2tp-tunnel.c
index a14bbd272e..f63951ea97 100644
--- a/src/network/netdev/l2tp-tunnel.c
+++ b/src/network/netdev/l2tp-tunnel.c
@@ -54,6 +54,11 @@ static L2tpSession* l2tp_session_free(L2tpSession *s) {
 
 DEFINE_SECTION_CLEANUP_FUNCTIONS(L2tpSession, l2tp_session_free);
 
+DEFINE_PRIVATE_HASH_OPS_WITH_VALUE_DESTRUCTOR(
+                l2tp_session_hash_ops_by_section,
+                ConfigSection, config_section_hash_func, config_section_compare_func,
+                L2tpSession, l2tp_session_free);
+
 static int l2tp_session_new_static(L2tpTunnel *t, const char *filename, unsigned section_line, L2tpSession **ret) {
         _cleanup_(config_section_freep) ConfigSection *n = NULL;
         _cleanup_(l2tp_session_freep) L2tpSession *s = NULL;
@@ -84,7 +89,7 @@ static int l2tp_session_new_static(L2tpTunnel *t, const char *filename, unsigned
                 .section = TAKE_PTR(n),
         };
 
-        r = ordered_hashmap_ensure_put(&t->sessions_by_section, &config_section_hash_ops, s->section, s);
+        r = ordered_hashmap_ensure_put(&t->sessions_by_section, &l2tp_session_hash_ops_by_section, s->section, s);
         if (r < 0)
                 return r;
 
@@ -904,7 +909,7 @@ static int netdev_l2tp_tunnel_get_ifindex(NetDev *netdev, const char *name) {
 static void l2tp_tunnel_done(NetDev *netdev) {
         L2tpTunnel *t = L2TP(netdev);
 
-        ordered_hashmap_free_with_destructor(t->sessions_by_section, l2tp_session_free);
+        ordered_hashmap_free(t->sessions_by_section);
         free(t->local_ifname);
 }
 
diff --git a/src/network/netdev/macsec.c b/src/network/netdev/macsec.c
index 6dd434f803..d367c5c87f 100644
--- a/src/network/netdev/macsec.c
+++ b/src/network/netdev/macsec.c
@@ -20,6 +20,12 @@
 #include "string-util.h"
 #include "unaligned.h"
 
+#define SECURITY_ASSOCIATION_NULL               \
+        (SecurityAssociation) {                 \
+                .activate = -1,                 \
+                .use_for_encoding = -1,         \
+        }
+
 static void security_association_clear(SecurityAssociation *sa) {
         if (!sa)
                 return;
@@ -29,13 +35,6 @@ static void security_association_clear(SecurityAssociation *sa) {
         free(sa->key_file);
 }
 
-static void security_association_init(SecurityAssociation *sa) {
-        assert(sa);
-
-        sa->activate = -1;
-        sa->use_for_encoding = -1;
-}
-
 static ReceiveAssociation* macsec_receive_association_free(ReceiveAssociation *c) {
         if (!c)
                 return NULL;
@@ -51,6 +50,11 @@ static ReceiveAssociation* macsec_receive_association_free(ReceiveAssociation *c
 
 DEFINE_SECTION_CLEANUP_FUNCTIONS(ReceiveAssociation, macsec_receive_association_free);
 
+DEFINE_PRIVATE_HASH_OPS_WITH_VALUE_DESTRUCTOR(
+                receive_association_hash_ops_by_section,
+                ConfigSection, config_section_hash_func, config_section_compare_func,
+                ReceiveAssociation, macsec_receive_association_free);
+
 static int macsec_receive_association_new_static(MACsec *s, const char *filename, unsigned section_line, ReceiveAssociation **ret) {
         _cleanup_(config_section_freep) ConfigSection *n = NULL;
         _cleanup_(macsec_receive_association_freep) ReceiveAssociation *c = NULL;
@@ -78,16 +82,14 @@ static int macsec_receive_association_new_static(MACsec *s, const char *filename
         *c = (ReceiveAssociation) {
                 .macsec = s,
                 .section = TAKE_PTR(n),
+                .sa = SECURITY_ASSOCIATION_NULL,
         };
 
-        security_association_init(&c->sa);
-
-        r = ordered_hashmap_ensure_put(&s->receive_associations_by_section, &config_section_hash_ops, c->section, c);
+        r = ordered_hashmap_ensure_put(&s->receive_associations_by_section, &receive_association_hash_ops_by_section, c->section, c);
         if (r < 0)
                 return r;
 
         *ret = TAKE_PTR(c);
-
         return 0;
 }
 
@@ -110,6 +112,16 @@ static ReceiveChannel* macsec_receive_channel_free(ReceiveChannel *c) {
 
 DEFINE_SECTION_CLEANUP_FUNCTIONS(ReceiveChannel, macsec_receive_channel_free);
 
+DEFINE_PRIVATE_HASH_OPS_WITH_VALUE_DESTRUCTOR(
+                receive_channel_hash_ops,
+                uint64_t, uint64_hash_func, uint64_compare_func,
+                ReceiveChannel, macsec_receive_channel_free);
+
+DEFINE_PRIVATE_HASH_OPS_WITH_VALUE_DESTRUCTOR(
+                receive_channel_hash_ops_by_section,
+                ConfigSection, config_section_hash_func, config_section_compare_func,
+                ReceiveChannel, macsec_receive_channel_free);
+
 static int macsec_receive_channel_new(MACsec *s, uint64_t sci, ReceiveChannel **ret) {
         ReceiveChannel *c;
 
@@ -154,12 +166,11 @@ static int macsec_receive_channel_new_static(MACsec *s, const char *filename, un
 
         c->section = TAKE_PTR(n);
 
-        r = ordered_hashmap_ensure_put(&s->receive_channels_by_section, &config_section_hash_ops, c->section, c);
+        r = ordered_hashmap_ensure_put(&s->receive_channels_by_section, &receive_channel_hash_ops_by_section, c->section, c);
         if (r < 0)
                 return r;
 
         *ret = TAKE_PTR(c);
-
         return 0;
 }
 
@@ -178,6 +189,11 @@ static TransmitAssociation* macsec_transmit_association_free(TransmitAssociation
 
 DEFINE_SECTION_CLEANUP_FUNCTIONS(TransmitAssociation, macsec_transmit_association_free);
 
+DEFINE_PRIVATE_HASH_OPS_WITH_VALUE_DESTRUCTOR(
+                transmit_association_hash_ops_by_section,
+                ConfigSection, config_section_hash_func, config_section_compare_func,
+                TransmitAssociation, macsec_transmit_association_free);
+
 static int macsec_transmit_association_new_static(MACsec *s, const char *filename, unsigned section_line, TransmitAssociation **ret) {
         _cleanup_(config_section_freep) ConfigSection *n = NULL;
         _cleanup_(macsec_transmit_association_freep) TransmitAssociation *a = NULL;
@@ -205,16 +221,14 @@ static int macsec_transmit_association_new_static(MACsec *s, const char *filenam
         *a = (TransmitAssociation) {
                 .macsec = s,
                 .section = TAKE_PTR(n),
+                .sa = SECURITY_ASSOCIATION_NULL,
         };
 
-        security_association_init(&a->sa);
-
-        r = ordered_hashmap_ensure_put(&s->transmit_associations_by_section, &config_section_hash_ops, a->section, a);
+        r = ordered_hashmap_ensure_put(&s->transmit_associations_by_section, &transmit_association_hash_ops_by_section, a->section, a);
         if (r < 0)
                 return r;
 
         *ret = TAKE_PTR(a);
-
         return 0;
 }
 
@@ -1018,7 +1032,7 @@ static int macsec_receive_channel_verify(ReceiveChannel *c) {
                                               "Ignoring [MACsecReceiveChannel] section from line %u",
                                               c->section->filename, c->section->line);
 
-        r = ordered_hashmap_ensure_put(&c->macsec->receive_channels, &uint64_hash_ops, &c->sci.as_uint64, c);
+        r = ordered_hashmap_ensure_put(&c->macsec->receive_channels, &receive_channel_hash_ops, &c->sci.as_uint64, c);
         if (r == -ENOMEM)
                 return log_oom();
         if (r == -EEXIST)
@@ -1108,7 +1122,7 @@ static int macsec_receive_association_verify(ReceiveAssociation *a) {
                 if (r < 0)
                         return log_oom();
 
-                r = ordered_hashmap_ensure_put(&a->macsec->receive_channels, &uint64_hash_ops, &new_channel->sci.as_uint64, new_channel);
+                r = ordered_hashmap_ensure_put(&a->macsec->receive_channels, &receive_channel_hash_ops, &new_channel->sci.as_uint64, new_channel);
                 if (r == -ENOMEM)
                         return log_oom();
                 if (r < 0)
@@ -1203,10 +1217,10 @@ static void macsec_init(NetDev *netdev) {
 static void macsec_done(NetDev *netdev) {
         MACsec *v = MACSEC(netdev);
 
-        ordered_hashmap_free_with_destructor(v->receive_channels, macsec_receive_channel_free);
-        ordered_hashmap_free_with_destructor(v->receive_channels_by_section, macsec_receive_channel_free);
-        ordered_hashmap_free_with_destructor(v->transmit_associations_by_section, macsec_transmit_association_free);
-        ordered_hashmap_free_with_destructor(v->receive_associations_by_section, macsec_receive_association_free);
+        ordered_hashmap_free(v->receive_channels);
+        ordered_hashmap_free(v->receive_channels_by_section);
+        ordered_hashmap_free(v->transmit_associations_by_section);
+        ordered_hashmap_free(v->receive_associations_by_section);
 }
 
 const NetDevVTable macsec_vtable = {
diff --git a/src/network/netdev/wireguard.c b/src/network/netdev/wireguard.c
index 5a58e1082c..f497c2533e 100644
--- a/src/network/netdev/wireguard.c
+++ b/src/network/netdev/wireguard.c
@@ -72,6 +72,11 @@ static WireguardPeer* wireguard_peer_free(WireguardPeer *peer) {
 
 DEFINE_SECTION_CLEANUP_FUNCTIONS(WireguardPeer, wireguard_peer_free);
 
+DEFINE_PRIVATE_HASH_OPS_WITH_VALUE_DESTRUCTOR(
+                wireguard_peer_hash_ops_by_section,
+                ConfigSection, config_section_hash_func, config_section_compare_func,
+                WireguardPeer, wireguard_peer_free);
+
 static int wireguard_peer_new_static(Wireguard *w, const char *filename, unsigned section_line, WireguardPeer **ret) {
         _cleanup_(config_section_freep) ConfigSection *n = NULL;
         _cleanup_(wireguard_peer_freep) WireguardPeer *peer = NULL;
@@ -104,7 +109,7 @@ static int wireguard_peer_new_static(Wireguard *w, const char *filename, unsigne
 
         LIST_PREPEND(peers, w->peers, peer);
 
-        r = hashmap_ensure_put(&w->peers_by_section, &config_section_hash_ops, peer->section, peer);
+        r = hashmap_ensure_put(&w->peers_by_section, &wireguard_peer_hash_ops_by_section, peer->section, peer);
         if (r < 0)
                 return r;
 
@@ -1077,7 +1082,7 @@ static void wireguard_done(NetDev *netdev) {
         explicit_bzero_safe(w->private_key, WG_KEY_LEN);
         free(w->private_key_file);
 
-        hashmap_free_with_destructor(w->peers_by_section, wireguard_peer_free);
+        hashmap_free(w->peers_by_section);
 
         set_free(w->routes);
 }