diff --git a/src/basic/fileio.c b/src/basic/fileio.c
index 24357c1ef8..bf1603de0e 100644
--- a/src/basic/fileio.c
+++ b/src/basic/fileio.c
@@ -118,7 +118,7 @@ FILE* fmemopen_unlocked(void *buf, size_t size, const char *mode) {
         return f;
 }
 
-int write_string_stream_ts(
+int write_string_stream_full(
                 FILE *f,
                 const char *line,
                 WriteStringFileFlags flags,
@@ -234,7 +234,7 @@ static int write_string_file_atomic_at(
         if (r < 0)
                 return r;
 
-        r = write_string_stream_ts(f, line, flags, ts);
+        r = write_string_stream_full(f, line, flags, ts);
         if (r < 0)
                 goto fail;
 
@@ -261,7 +261,7 @@ fail:
         return r;
 }
 
-int write_string_file_ts_at(
+int write_string_file_full(
                 int dir_fd,
                 const char *fn,
                 const char *line,
@@ -314,7 +314,7 @@ int write_string_file_ts_at(
         if (flags & WRITE_STRING_FILE_DISABLE_BUFFER)
                 setvbuf(f, NULL, _IONBF, 0);
 
-        r = write_string_stream_ts(f, line, flags, ts);
+        r = write_string_stream_full(f, line, flags, ts);
         if (r < 0)
                 goto fail;
 
diff --git a/src/basic/fileio.h b/src/basic/fileio.h
index 6986ed3276..dc514e3ccc 100644
--- a/src/basic/fileio.h
+++ b/src/basic/fileio.h
@@ -51,25 +51,21 @@ DIR* take_fdopendir(int *dfd);
 FILE* open_memstream_unlocked(char **ptr, size_t *sizeloc);
 FILE* fmemopen_unlocked(void *buf, size_t size, const char *mode);
 
-int write_string_stream_ts(FILE *f, const char *line, WriteStringFileFlags flags, const struct timespec *ts);
+int write_string_stream_full(FILE *f, const char *line, WriteStringFileFlags flags, const struct timespec *ts);
 static inline int write_string_stream(FILE *f, const char *line, WriteStringFileFlags flags) {
-        return write_string_stream_ts(f, line, flags, NULL);
+        return write_string_stream_full(f, line, flags, /* ts= */ NULL);
 }
-int write_string_file_ts_at(int dir_fd, const char *fn, const char *line, WriteStringFileFlags flags, const struct timespec *ts);
-static inline int write_string_file_ts(const char *fn, const char *line, WriteStringFileFlags flags, const struct timespec *ts) {
-        return write_string_file_ts_at(AT_FDCWD, fn, line, flags, ts);
+int write_string_file_full(int dir_fd, const char *fn, const char *line, WriteStringFileFlags flags, const struct timespec *ts);
+static inline int write_string_file(const char *fn, const char *line, WriteStringFileFlags flags) {
+        return write_string_file_full(AT_FDCWD, fn, line, flags, /* ts= */ NULL);
 }
 static inline int write_string_file_at(int dir_fd, const char *fn, const char *line, WriteStringFileFlags flags) {
-        return write_string_file_ts_at(dir_fd, fn, line, flags, NULL);
-}
-static inline int write_string_file(const char *fn, const char *line, WriteStringFileFlags flags) {
-        return write_string_file_ts(fn, line, flags, NULL);
+        return write_string_file_full(dir_fd, fn, line, flags, /* ts= */ NULL);
 }
+int write_string_filef(const char *fn, WriteStringFileFlags flags, const char *format, ...) _printf_(3, 4);
 
 int write_base64_file_at(int dir_fd, const char *fn, const struct iovec *data, WriteStringFileFlags flags);
 
-int write_string_filef(const char *fn, WriteStringFileFlags flags, const char *format, ...) _printf_(3, 4);
-
 int read_one_line_file_at(int dir_fd, const char *filename, char **ret);
 static inline int read_one_line_file(const char *filename, char **ret) {
         return read_one_line_file_at(AT_FDCWD, filename, ret);
diff --git a/src/debug-generator/debug-generator.c b/src/debug-generator/debug-generator.c
index 7637980689..98670a6c90 100644
--- a/src/debug-generator/debug-generator.c
+++ b/src/debug-generator/debug-generator.c
@@ -206,7 +206,7 @@ static int process_unit_credentials(const char *credentials_dir) {
                         if (!p)
                                 return log_oom();
 
-                        r = write_string_file_atomic_label(p, d);
+                        r = write_string_file_at_label(AT_FDCWD, p, d, WRITE_STRING_FILE_CREATE|WRITE_STRING_FILE_ATOMIC|WRITE_STRING_FILE_MKDIR_0755);
                         if (r < 0) {
                                 log_warning_errno(r, "Failed to write unit file '%s' from credential '%s', ignoring: %m",
                                                   unit, de->d_name);
diff --git a/src/shared/dropin.c b/src/shared/dropin.c
index c3050634bd..3e1eaa6623 100644
--- a/src/shared/dropin.c
+++ b/src/shared/dropin.c
@@ -31,14 +31,11 @@ int drop_in_file(
                 char **ret_unit_dir,
                 char **ret_path) {
 
-        char prefix[DECIMAL_STR_MAX(unsigned) + 1] = {};
-        _cleanup_free_ char *n = NULL, *unit_dir = NULL, *path = NULL;
+        _cleanup_free_ char *n = NULL, *unit_dir = NULL;
 
         assert(dir);
         assert(unit);
         assert(name);
-        assert(ret_unit_dir);
-        assert(ret_path);
 
         n = xescape(name, "/.");
         if (!n)
@@ -46,16 +43,28 @@ int drop_in_file(
         if (!filename_is_valid(n))
                 return -EINVAL;
 
-        if (level != UINT_MAX)
-                xsprintf(prefix, "%u-", level);
+        if (ret_unit_dir || ret_path) {
+                unit_dir = path_join(dir, strjoina(unit, ".d"));
+                if (!unit_dir)
+                        return -ENOMEM;
+        }
 
-        unit_dir = path_join(dir, strjoina(unit, ".d"));
-        path = strjoin(unit_dir, "/", prefix, n, ".conf");
-        if (!unit_dir || !path)
-                return -ENOMEM;
+        if (ret_path) {
+                char prefix[DECIMAL_STR_MAX(unsigned) + 1] = {};
+
+                if (level != UINT_MAX)
+                        xsprintf(prefix, "%u-", level);
+
+                _cleanup_free_ char *path = strjoin(unit_dir, "/", prefix, n, ".conf");
+                if (!path)
+                        return -ENOMEM;
+
+                *ret_path = TAKE_PTR(path);
+        }
+
+        if (ret_unit_dir)
+                *ret_unit_dir = TAKE_PTR(unit_dir);
 
-        *ret_unit_dir = TAKE_PTR(unit_dir);
-        *ret_path = TAKE_PTR(path);
         return 0;
 }
 
@@ -66,7 +75,7 @@ int write_drop_in(
                 const char *name,
                 const char *data) {
 
-        _cleanup_free_ char *p = NULL, *q = NULL;
+        _cleanup_free_ char *p = NULL;
         int r;
 
         assert(dir);
@@ -74,12 +83,11 @@ int write_drop_in(
         assert(name);
         assert(data);
 
-        r = drop_in_file(dir, unit, level, name, &p, &q);
+        r = drop_in_file(dir, unit, level, name, /* ret_unit_dir= */ NULL, &p);
         if (r < 0)
                 return r;
 
-        (void) mkdir_p(p, 0755);
-        return write_string_file_atomic_label(q, data);
+        return write_string_file_at_label(AT_FDCWD, p, data, WRITE_STRING_FILE_CREATE|WRITE_STRING_FILE_ATOMIC|WRITE_STRING_FILE_MKDIR_0755);
 }
 
 int write_drop_in_format(
diff --git a/src/shared/fileio-label.c b/src/shared/fileio-label.c
index 572b8f62ad..39de54fa25 100644
--- a/src/shared/fileio-label.c
+++ b/src/shared/fileio-label.c
@@ -6,14 +6,14 @@
 #include "fileio.h"
 #include "selinux-util.h"
 
-int write_string_file_atomic_label_ts(const char *fn, const char *line, struct timespec *ts) {
+int write_string_file_full_label(int atfd, const char *fn, const char *line, WriteStringFileFlags flags, struct timespec *ts) {
         int r;
 
-        r = mac_selinux_create_file_prepare(fn, S_IFREG);
+        r = mac_selinux_create_file_prepare_at(atfd, fn, S_IFREG);
         if (r < 0)
                 return r;
 
-        r = write_string_file_ts(fn, line, WRITE_STRING_FILE_CREATE|WRITE_STRING_FILE_ATOMIC, ts);
+        r = write_string_file_full(atfd, fn, line, flags, ts);
 
         mac_selinux_create_file_clear();
 
diff --git a/src/shared/fileio-label.h b/src/shared/fileio-label.h
index 03b4a16417..5aa5c40224 100644
--- a/src/shared/fileio-label.h
+++ b/src/shared/fileio-label.h
@@ -7,9 +7,14 @@
  * optimize linking: This way, -lselinux is needed only for the callers of these functions that need selinux, but not
  * for all */
 
-int write_string_file_atomic_label_ts(const char *fn, const char *line, struct timespec *ts);
+#include "fileio.h"
+
+int write_string_file_full_label(int atfd, const char *fn, const char *line, WriteStringFileFlags flags, struct timespec *ts);
+static inline int write_string_file_at_label(int atfd, const char *fn, const char *line, WriteStringFileFlags flags) {
+        return write_string_file_full_label(atfd, fn, line, flags, /* ts= */ NULL);
+}
 static inline int write_string_file_atomic_label(const char *fn, const char *line) {
-        return write_string_file_atomic_label_ts(fn, line, NULL);
+        return write_string_file_at_label(AT_FDCWD, fn, line, WRITE_STRING_FILE_CREATE|WRITE_STRING_FILE_ATOMIC);
 }
 
 int create_shutdown_run_nologin_or_warn(void);
diff --git a/src/update-done/update-done.c b/src/update-done/update-done.c
index f448b3b1d1..436bae639b 100644
--- a/src/update-done/update-done.c
+++ b/src/update-done/update-done.c
@@ -29,7 +29,7 @@ static int apply_timestamp(const char *path, struct timespec *ts) {
                      timespec_load_nsec(ts)) < 0)
                 return log_oom();
 
-        r = write_string_file_atomic_label_ts(path, message, ts);
+        r = write_string_file_full_label(AT_FDCWD, path, message, WRITE_STRING_FILE_CREATE|WRITE_STRING_FILE_ATOMIC, ts);
         if (r == -EROFS)
                 log_debug_errno(r, "Cannot create \"%s\", file system is read-only.", path);
         else if (r < 0)