diff --git a/.github/workflows/build-test.sh b/.github/workflows/build-test.sh
index 084e2c4f1a..6d8324b945 100755
--- a/.github/workflows/build-test.sh
+++ b/.github/workflows/build-test.sh
@@ -15,7 +15,7 @@ ARGS=(
     "--optimization=2 -Ddns-over-tls=openssl -Dc_args='-DOPENSSL_NO_DEPRECATED'"
     "--optimization=3 -Db_lto=true -Ddns-over-tls=false"
     "--optimization=3 -Db_lto=false -Dtpm2=disabled -Dlibfido2=disabled -Dp11kit=disabled -Defi=false -Dbootloader=disabled"
-    "--optimization=3 -Dfexecve=true -Dstandalone-binaries=true -Dstatic-libsystemd=true -Dstatic-libudev=true"
+    "--optimization=3 -Dfexecve=true -Dstandalone-binaries=true -Dstatic-libsystemd=true -Dstatic-libudev=true -Dsystemd-multicall-binary=true"
     "-Db_ndebug=true"
     "--auto-features=disabled -Dcompat-mutable-uid-boundaries=true"
 )
diff --git a/meson.build b/meson.build
index a5572301db..1ce4c95368 100644
--- a/meson.build
+++ b/meson.build
@@ -1028,13 +1028,18 @@ endif
 
 if get_option('libc') == 'musl'
         libcrypt = []
-        libcrypt_cflags = []
+        libcrypt_cflags = declare_dependency(
+                compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBCRYPT',
+        )
         have = get_option('libcrypt').allowed()
 else
         libcrypt = dependency('libcrypt', 'libxcrypt',
                               required : get_option('libcrypt'),
                               version : '>=4.4.0')
-        libcrypt_cflags = libcrypt.partial_dependency(includes: true, compile_args: true)
+        libcrypt_cflags = declare_dependency(
+                dependencies : libcrypt.partial_dependency(includes: true, compile_args: true),
+                compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBCRYPT',
+        )
         have = libcrypt.found()
 endif
 conf.set10('HAVE_LIBCRYPT', have)
@@ -1052,7 +1057,10 @@ bpf_compiler = get_option('bpf-compiler')
 libbpf = dependency('libbpf',
                     required : bpf_framework,
                     version : bpf_compiler == 'gcc' ? '>= 1.4.0' : '>= 0.1.0')
-libbpf_cflags = libbpf.partial_dependency(includes: true, compile_args: true)
+libbpf_cflags = declare_dependency(
+        dependencies : libbpf.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBBPF',
+)
 conf.set10('HAVE_LIBBPF', libbpf.found())
 
 libmount = dependency('mount',
@@ -1060,12 +1068,18 @@ libmount = dependency('mount',
                       required : get_option('libmount'))
 have = libmount.found()
 conf.set10('HAVE_LIBMOUNT', have)
-libmount_cflags = libmount.partial_dependency(includes: true, compile_args: true)
+libmount_cflags = declare_dependency(
+        dependencies : libmount.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBMOUNT',
+)
 
 libfdisk = dependency('fdisk',
                       version : '>= 2.35',
                       required : get_option('fdisk'))
-libfdisk_cflags = libfdisk.partial_dependency(includes: true, compile_args: true)
+libfdisk_cflags = declare_dependency(
+        dependencies : libfdisk.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBFDISK',
+)
 conf.set10('HAVE_LIBFDISK', libfdisk.found())
 
 # This prefers pwquality if both are enabled or auto.
@@ -1079,7 +1093,10 @@ if not have
         libpwquality = dependency('passwdqc',
                                   required : get_option('passwdqc'))
 endif
-libpwquality_cflags = libpwquality.partial_dependency(includes: true, compile_args: true)
+libpwquality_cflags = declare_dependency(
+        dependencies : libpwquality.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBPWQUALITY',
+)
 conf.set10('HAVE_PWQUALITY', have)
 conf.set10('HAVE_PASSWDQC', not have and libpwquality.found())
 
@@ -1087,19 +1104,28 @@ libseccomp = dependency('libseccomp',
                         version : '>= 2.4.0',
                         required : get_option('seccomp'))
 conf.set10('HAVE_SECCOMP', libseccomp.found())
-libseccomp_cflags = libseccomp.partial_dependency(includes: true, compile_args: true)
+libseccomp_cflags = declare_dependency(
+        dependencies : libseccomp.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBSECCOMP',
+)
 
 libselinux = dependency('libselinux',
                         version : '>= 2.1.9',
                         required : get_option('selinux'))
 conf.set10('HAVE_SELINUX', libselinux.found())
-libselinux_cflags = libselinux.partial_dependency(includes: true, compile_args: true)
+libselinux_cflags = declare_dependency(
+        dependencies : libselinux.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBSELINUX',
+)
 
 libapparmor = dependency('libapparmor',
                          version : '>= 2.13',
                          required : get_option('apparmor'))
 conf.set10('HAVE_APPARMOR', libapparmor.found())
-libapparmor_cflags = libapparmor.partial_dependency(includes: true, compile_args: true)
+libapparmor_cflags = declare_dependency(
+        dependencies : libapparmor.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBAPPARMOR',
+)
 
 have = get_option('smack') and get_option('smack-run-label') != ''
 conf.set10('HAVE_SMACK_RUN_LABEL', have)
@@ -1125,30 +1151,45 @@ conf.set10('ENABLE_POLKIT', install_polkit)
 libacl = dependency('libacl',
                     required : get_option('acl'))
 conf.set10('HAVE_ACL', libacl.found())
-libacl_cflags = libacl.partial_dependency(includes: true, compile_args: true)
+libacl_cflags = declare_dependency(
+        dependencies : libacl.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBACL',
+)
 
 libaudit = dependency('audit',
                       required : get_option('audit'))
 conf.set10('HAVE_AUDIT', libaudit.found())
-libaudit_cflags = libaudit.partial_dependency(includes: true, compile_args: true)
+libaudit_cflags = declare_dependency(
+        dependencies : libaudit.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBAUDIT',
+)
 
 libblkid = dependency('blkid',
                       version : '>=2.37.0',
                       required : get_option('blkid'))
 conf.set10('HAVE_BLKID', libblkid.found())
-libblkid_cflags = libblkid.partial_dependency(includes: true, compile_args: true)
+libblkid_cflags = declare_dependency(
+        dependencies : libblkid.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBBLKID',
+)
 
 libkmod = dependency('libkmod',
                      version : '>= 15',
                      required : get_option('kmod'))
 conf.set10('HAVE_KMOD', libkmod.found())
-libkmod_cflags = libkmod.partial_dependency(includes: true, compile_args: true)
+libkmod_cflags = declare_dependency(
+        dependencies : libkmod.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBKMOD',
+)
 
 libxenctrl = dependency('xencontrol',
                         version : '>= 4.9',
                         required : get_option('xenctrl'))
 conf.set10('HAVE_XENCTRL', libxenctrl.found())
-libxenctrl_cflags = libxenctrl.partial_dependency(includes: true, compile_args: true)
+libxenctrl_cflags = declare_dependency(
+        dependencies : libxenctrl.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBXENCTRL',
+)
 
 feature = get_option('pam')
 libpam = dependency('pam',
@@ -1158,13 +1199,19 @@ if not libpam.found()
         libpam = cc.find_library('pam', required : feature)
 endif
 conf.set10('HAVE_PAM', libpam.found())
-libpam_cflags = libpam.partial_dependency(includes: true, compile_args: true)
+libpam_cflags = declare_dependency(
+        dependencies : libpam.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBPAM',
+)
 
 libmicrohttpd = dependency('libmicrohttpd',
                            version : '>= 0.9.33',
                            required : get_option('microhttpd'))
 conf.set10('HAVE_MICROHTTPD', libmicrohttpd.found())
-libmicrohttpd_cflags = libmicrohttpd.partial_dependency(includes: true, compile_args: true)
+libmicrohttpd_cflags = declare_dependency(
+        dependencies : libmicrohttpd.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBMICROHTTPD',
+)
 
 libcryptsetup = get_option('libcryptsetup')
 libcryptsetup_plugins = get_option('libcryptsetup-plugins')
@@ -1178,7 +1225,10 @@ endif
 libcryptsetup = dependency('libcryptsetup',
                            version : '>= 2.4.0',
                            required : libcryptsetup)
-libcryptsetup_cflags = libcryptsetup.partial_dependency(includes: true, compile_args: true)
+libcryptsetup_cflags = declare_dependency(
+        dependencies : libcryptsetup.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBCRYPTSETUP',
+)
 
 have = libcryptsetup.found()
 conf.set10('HAVE_LIBCRYPTSETUP', have)
@@ -1188,19 +1238,28 @@ conf.set10('HAVE_LIBCRYPTSETUP_PLUGINS',
 libcurl = dependency('libcurl',
                      version : '>= 7.32.0',
                      required : get_option('libcurl'))
-libcurl_cflags = libcurl.partial_dependency(includes: true, compile_args: true)
+libcurl_cflags = declare_dependency(
+        dependencies : libcurl.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBCURL',
+)
 conf.set10('HAVE_LIBCURL', libcurl.found())
 conf.set10('CURL_NO_OLDIES', conf.get('BUILD_MODE_DEVELOPER') == 1)
 
 libidn2 = dependency('libidn2',
                      required : get_option('libidn2'))
-libidn2_cflags = libidn2.partial_dependency(includes: true, compile_args: true)
+libidn2_cflags = declare_dependency(
+        dependencies : libidn2.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBIDN2',
+)
 conf.set10('HAVE_LIBIDN2', libidn2.found())
 
 libqrencode = dependency('libqrencode',
                          version : '>= 3',
                          required : get_option('qrencode'))
-libqrencode_cflags = libqrencode.partial_dependency(includes: true, compile_args: true)
+libqrencode_cflags = declare_dependency(
+        dependencies : libqrencode.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBQRENCODE',
+)
 conf.set10('HAVE_QRENCODE', libqrencode.found())
 
 feature = get_option('gcrypt')
@@ -1208,7 +1267,10 @@ libgcrypt = dependency('libgcrypt',
                        required : feature.disabled() ? feature : false)
 conf.set10('HAVE_GCRYPT', libgcrypt.found())
 if libgcrypt.found()
-        libgcrypt_cflags = libgcrypt.partial_dependency(includes: true, compile_args: true)
+        libgcrypt_cflags = declare_dependency(
+                dependencies : libgcrypt.partial_dependency(includes: true, compile_args: true),
+                compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBGCRYPT',
+        )
 else
         libgcrypt_cflags = []
 endif
@@ -1217,48 +1279,78 @@ libgnutls = dependency('gnutls',
                        version : '>= 3.1.4',
                        required : get_option('gnutls'))
 conf.set10('HAVE_GNUTLS', libgnutls.found())
-libgnutls_cflags = libgnutls.partial_dependency(includes: true, compile_args: true)
+libgnutls_cflags = declare_dependency(
+        dependencies : libgnutls.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBGNUTLS',
+)
 
 libopenssl = dependency('openssl',
                         version : '>= 3.0.0',
                         required : get_option('openssl'))
-libopenssl_cflags = libopenssl.partial_dependency(includes: true, compile_args: true)
+libopenssl_cflags = declare_dependency(
+        dependencies : libopenssl.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBOPENSSL',
+)
 conf.set10('HAVE_OPENSSL', libopenssl.found())
 
 libp11kit = dependency('p11-kit-1',
                        version : '>= 0.23.3',
                        required : get_option('p11kit'))
 conf.set10('HAVE_P11KIT', libp11kit.found())
-libp11kit_cflags = libp11kit.partial_dependency(includes: true, compile_args: true)
+libp11kit_cflags = declare_dependency(
+        dependencies : libp11kit.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBP11KIT',
+)
 
 feature = get_option('libfido2').require(
         conf.get('HAVE_OPENSSL') == 1,
         error_message : 'openssl required')
 libfido2 = dependency('libfido2',
                       required : feature)
-libfido2_cflags = libfido2.partial_dependency(includes: true, compile_args: true)
+libfido2_cflags = declare_dependency(
+        dependencies : libfido2.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBFIDO2',
+)
 conf.set10('HAVE_LIBFIDO2', libfido2.found())
 
-tpm2 = dependency('tss2-esys tss2-rc tss2-mu tss2-tcti-device',
-                  required : get_option('tpm2'))
-tpm2_cflags = tpm2.partial_dependency(includes: true, compile_args: true)
-conf.set10('HAVE_TPM2', tpm2.found())
-conf.set10('HAVE_TSS2_ESYS3', tpm2.found() and tpm2.version().version_compare('>= 3.0.0'))
+tss2_esys = dependency('tss2-esys', required : get_option('tpm2'))
+tss2_mu = dependency('tss2-mu', required : get_option('tpm2'))
+tss2_rc = dependency('tss2-rc', required : get_option('tpm2'))
+tss2_tcti_device = dependency('tss2-tcti-device', required : get_option('tpm2'))
+tpm2_cflags = declare_dependency(
+        dependencies : [
+                tss2_esys.partial_dependency(includes: true, compile_args: true),
+                tss2_mu.partial_dependency(includes: true, compile_args: true),
+                tss2_rc.partial_dependency(includes: true, compile_args: true),
+                tss2_tcti_device.partial_dependency(includes: true, compile_args: true),
+        ],
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_TPM2',
+)
+conf.set10('HAVE_TPM2', tss2_esys.found() and tss2_mu.found() and tss2_rc.found() and tss2_tcti_device.found())
+conf.set10('HAVE_TSS2_ESYS3', tss2_esys.found() and tss2_esys.version().version_compare('>= 3.0.0'))
 conf.set('TPM2_NVPCR_BASE', get_option('tpm2-nvpcr-base'))
 
 libdw = dependency('libdw',
                    version : '>=0.177',
                    required : get_option('elfutils'))
-libdw_cflags = libdw.partial_dependency(includes: true, compile_args: true)
 libelf = dependency('libelf',
                     required : get_option('elfutils'))
-libelf_cflags = libelf.partial_dependency(includes: true, compile_args: true)
+libelf_cflags = declare_dependency(
+        dependencies : [
+                libelf.partial_dependency(includes: true, compile_args: true),
+                libdw.partial_dependency(includes: true, compile_args: true),
+        ],
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBELF',
+)
 conf.set10('HAVE_ELFUTILS', libdw.found() and libelf.found())
 
 libz = dependency('zlib',
                   required : get_option('zlib'))
 conf.set10('HAVE_ZLIB', libz.found())
-libz_cflags = libz.partial_dependency(includes: true, compile_args: true)
+libz_cflags = declare_dependency(
+        dependencies : libz.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBZ',
+)
 
 feature = get_option('bzip2')
 libbzip2 = dependency('bzip2',
@@ -1268,24 +1360,36 @@ if not libbzip2.found()
         libbzip2 = cc.find_library('bz2', required : feature)
 endif
 conf.set10('HAVE_BZIP2', libbzip2.found())
-libbzip2_cflags = libbzip2.partial_dependency(includes: true, compile_args: true)
+libbzip2_cflags = declare_dependency(
+        dependencies : libbzip2.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBBZIP2',
+)
 
 libxz = dependency('liblzma',
                    required : get_option('xz'))
 conf.set10('HAVE_XZ', libxz.found())
-libxz_cflags = libxz.partial_dependency(includes: true, compile_args: true)
+libxz_cflags = declare_dependency(
+        dependencies : libxz.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBXZ',
+)
 
 liblz4 = dependency('liblz4',
                     version : '>= 1.3.0',
                     required : get_option('lz4'))
 conf.set10('HAVE_LZ4', liblz4.found())
-liblz4_cflags = liblz4.partial_dependency(includes: true, compile_args: true)
+liblz4_cflags = declare_dependency(
+        dependencies : liblz4.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBLZ4',
+)
 
 libzstd = dependency('libzstd',
                      version : '>= 1.4.0',
                      required : get_option('zstd'))
 conf.set10('HAVE_ZSTD', libzstd.found())
-libzstd_cflags = libzstd.partial_dependency(includes: true, compile_args: true)
+libzstd_cflags = declare_dependency(
+        dependencies : libzstd.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBZSTD',
+)
 
 conf.set10('HAVE_COMPRESSION', libxz.found() or liblz4.found() or libzstd.found())
 
@@ -1321,18 +1425,27 @@ conf.set('DEFAULT_COMPRESSION', 'COMPRESSION_@0@'.format(compression.to_upper())
 libarchive = dependency('libarchive',
                         version : '>= 3.0',
                         required : get_option('libarchive'))
-libarchive_cflags = libarchive.partial_dependency(includes: true, compile_args: true)
+libarchive_cflags = declare_dependency(
+        dependencies : libarchive.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBARCHIVE',
+)
 conf.set10('HAVE_LIBARCHIVE', libarchive.found())
 
 libxkbcommon = dependency('xkbcommon',
                           version : '>= 0.3.0',
                           required : get_option('xkbcommon'))
-libxkbcommon_cflags = libxkbcommon.partial_dependency(includes: true, compile_args: true)
+libxkbcommon_cflags = declare_dependency(
+        dependencies : libxkbcommon.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBXKBCOMMON',
+)
 conf.set10('HAVE_XKBCOMMON', libxkbcommon.found())
 
 libpcre2 = dependency('libpcre2-8',
                       required : get_option('pcre2'))
-libpcre2_cflags = libpcre2.partial_dependency(includes: true, compile_args: true)
+libpcre2_cflags = declare_dependency(
+        dependencies : libpcre2.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBPCRE2',
+)
 conf.set10('HAVE_PCRE2', libpcre2.found())
 
 libglib =    dependency('glib-2.0',
@@ -1344,15 +1457,23 @@ libgobject = dependency('gobject-2.0',
 libgio =     dependency('gio-2.0',
                         required : get_option('glib'))
 conf.set10('HAVE_GLIB', libglib.found() and libgobject.found() and libgio.found())
-libglib_cflags = libglib.partial_dependency(includes: true, compile_args: true)
-libgobject_cflags = libgobject.partial_dependency(includes: true, compile_args: true)
-libgio_cflags = libgio.partial_dependency(includes: true, compile_args: true)
+libglib_cflags = declare_dependency(
+        dependencies : [
+                libglib.partial_dependency(includes: true, compile_args: true),
+                libgobject.partial_dependency(includes: true, compile_args: true),
+                libgio.partial_dependency(includes: true, compile_args: true),
+        ],
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBGLIB',
+)
 
 libdbus = dependency('dbus-1',
                      version : '>= 1.3.2',
                      required : get_option('dbus'))
 conf.set10('HAVE_DBUS', libdbus.found())
-libdbus_cflags = libdbus.partial_dependency(includes: true, compile_args: true)
+libdbus_cflags = declare_dependency(
+        dependencies : libdbus.partial_dependency(includes: true, compile_args: true),
+        compile_args : '-DSYSTEMD_CFLAGS_MARKER_LIBDBUS',
+)
 
 dbusdatadir = libdbus.get_variable(pkgconfig: 'datadir', default_value: datadir) / 'dbus-1'
 
@@ -1811,12 +1932,16 @@ if static_libsystemd != 'false'
                 install_tag: 'libsystemd',
                 install_dir : libdir,
                 pic : static_libsystemd_pic,
-                dependencies : [liblz4_cflags,
-                                libm,
-                                libucontext,
-                                libxz_cflags,
-                                libzstd_cflags,
-                                userspace],
+                dependencies : [
+                        libbzip2_cflags,
+                        liblz4_cflags,
+                        libm,
+                        libucontext,
+                        libxz_cflags,
+                        libz_cflags,
+                        libzstd_cflags,
+                        userspace,
+                ],
                 c_args : libsystemd_c_args + (static_libsystemd_pic ? [] : ['-fno-PIC']))
 
         alias_target('libsystemd', libsystemd, install_libsystemd_static)
@@ -1854,8 +1979,15 @@ if static_libudev != 'false'
                 install_tag: 'libudev',
                 install_dir : libdir,
                 link_depends : libudev_sym,
-                dependencies : [libshared_deps,
-                                userspace],
+                dependencies : [
+                        libbzip2_cflags,
+                        liblz4_cflags,
+                        libshared_deps,
+                        libxz_cflags,
+                        libz_cflags,
+                        libzstd_cflags,
+                        userspace,
+                ],
                 c_args : static_libudev_pic ? [] : ['-fno-PIC'],
                 pic : static_libudev_pic)
 
diff --git a/src/analyze/meson.build b/src/analyze/meson.build
index 67001845ac..a8232eb851 100644
--- a/src/analyze/meson.build
+++ b/src/analyze/meson.build
@@ -55,7 +55,10 @@ executables += [
                         libcore,
                         libshared,
                 ],
-                'dependencies' : libseccomp_cflags,
+                'dependencies' : [
+                        libseccomp_cflags,
+                        tpm2_cflags,
+                ],
                 'install' : conf.get('ENABLE_ANALYZE') == 1,
         },
         core_test_template + {
diff --git a/src/basic/compress.c b/src/basic/compress.c
index d750657818..70d0b7ced3 100644
--- a/src/basic/compress.c
+++ b/src/basic/compress.c
@@ -6,25 +6,40 @@
 #include <unistd.h>
 
 #if HAVE_XZ
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBXZ
+#  error "missing libxz_cflags in meson dependency."
+#endif
 #include <lzma.h>
 #endif
 
 #if HAVE_LZ4
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBLZ4
+#  error "missing liblz4_cflags in meson dependency."
+#endif
 #include <lz4.h>
 #include <lz4frame.h>
 #include <lz4hc.h>
 #endif
 
 #if HAVE_ZSTD
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBZSTD
+#  error "missing libzstd_cflags in meson dependency."
+#endif
 #include <zstd.h>
 #include <zstd_errors.h>
 #endif
 
 #if HAVE_ZLIB
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBZ
+#  error "missing libz_cflags in meson dependency."
+#endif
 #include <zlib.h>
 #endif
 
 #if HAVE_BZIP2
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBBZIP2
+#  error "missing libbzip2_cflags in meson dependency."
+#endif
 #include <bzlib.h>
 #endif
 
diff --git a/src/bootctl/meson.build b/src/bootctl/meson.build
index 06137bdae0..958a804b80 100644
--- a/src/bootctl/meson.build
+++ b/src/bootctl/meson.build
@@ -24,7 +24,10 @@ executables += [
                 ],
                 'sources' : bootctl_sources,
                 'link_with' : boot_link_with,
-                'dependencies' : [libopenssl_cflags],
+                'dependencies' : [
+                        libopenssl_cflags,
+                        tpm2_cflags,
+                ],
         },
         test_template + {
                 'sources' : files(
diff --git a/src/core/meson.build b/src/core/meson.build
index 26c84fa78b..e46698b4cf 100644
--- a/src/core/meson.build
+++ b/src/core/meson.build
@@ -174,14 +174,18 @@ libcore_static = static_library(
         include_directories : core_includes,
         implicit_include_directories : false,
         c_args : ['-fvisibility=default'],
-        dependencies : [libaudit_cflags,
-                        libbpf_cflags,
-                        libcryptsetup_cflags,
-                        libm,
-                        libmount_cflags,
-                        libseccomp_cflags,
-                        libselinux_cflags,
-                        userspace],
+        dependencies : [
+                libacl_cflags,
+                libaudit_cflags,
+                libbpf_cflags,
+                libcryptsetup_cflags,
+                libm,
+                libmount_cflags,
+                libpcre2_cflags,
+                libseccomp_cflags,
+                libselinux_cflags,
+                userspace,
+        ],
         build_by_default : false)
 
 libcore = shared_library(
@@ -210,6 +214,7 @@ core_libs_shared = [
 
 systemd_deps = [
         libapparmor_cflags,
+        libaudit_cflags,
         libkmod_cflags,
         libmount_cflags,
         libseccomp_cflags,
@@ -226,6 +231,7 @@ if conf.get('SYSTEMD_MULTICALL_BINARY') == 1
         systemd_deps += [
                 libbpf_cflags,
                 libcryptsetup_cflags,
+                libopenssl_cflags,
                 libpam_cflags,
         ]
 endif
@@ -282,6 +288,7 @@ else
                                 libbpf_cflags,
                                 libcryptsetup_cflags,
                                 libmount_cflags,
+                                libopenssl_cflags,
                                 libpam_cflags,
                                 libseccomp_cflags,
                                 libselinux_cflags,
diff --git a/src/core/service.c b/src/core/service.c
index 9e4af299f7..012336b47a 100644
--- a/src/core/service.c
+++ b/src/core/service.c
@@ -1,6 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <linux/audit.h>        /* IWYU pragma: keep */
 #include <linux/liveupdate.h>
 #include <math.h>
 #include <sys/stat.h>
@@ -36,6 +35,7 @@
 #include "glyph-util.h"
 #include "id128-util.h"
 #include "image-policy.h"
+#include "libaudit-util.h"      /* IWYU pragma: keep */
 #include "log.h"
 #include "luo-util.h"
 #include "manager.h"
diff --git a/src/coredump/meson.build b/src/coredump/meson.build
index b0753d86fa..b1286f80ff 100644
--- a/src/coredump/meson.build
+++ b/src/coredump/meson.build
@@ -38,7 +38,10 @@ executables += [
                 'sources' : systemd_coredump_sources,
                 'extract' : systemd_coredump_extract_sources,
                 'link_with' : [libshared],
-                'dependencies' : common_dependencies,
+                'dependencies' : [
+                        common_dependencies,
+                        libacl_cflags,
+                ],
         },
         executable_template + {
                 'name' : 'coredumpctl',
diff --git a/src/creds/meson.build b/src/creds/meson.build
index c18fe2ec89..6a14f8e075 100644
--- a/src/creds/meson.build
+++ b/src/creds/meson.build
@@ -12,6 +12,7 @@ executables += [
                 'dependencies' : [
                         libmount_cflags,
                         libopenssl_cflags,
+                        tpm2_cflags,
                 ],
         },
 ]
diff --git a/src/cryptenroll/meson.build b/src/cryptenroll/meson.build
index 3fbb5bf080..f0d08ea56c 100644
--- a/src/cryptenroll/meson.build
+++ b/src/cryptenroll/meson.build
@@ -27,6 +27,7 @@ executables += [
                         libfido2_cflags,
                         libopenssl_cflags,
                         libp11kit_cflags,
+                        tpm2_cflags,
                 ],
         },
 ]
diff --git a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-fido2.c b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-fido2.c
index 0bfe0c2ec7..4cf6b7654c 100644
--- a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-fido2.c
+++ b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-fido2.c
@@ -1,6 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <libcryptsetup.h>
 #include <string.h>
 #include <syslog.h>
 
diff --git a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-pkcs11.c b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-pkcs11.c
index 63be8a7c64..6952bb7ca2 100644
--- a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-pkcs11.c
+++ b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-pkcs11.c
@@ -1,6 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <libcryptsetup.h>
 #include <syslog.h>
 
 #include "sd-json.h"
diff --git a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-tpm2.c b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-tpm2.c
index 552d81da17..450399ec12 100644
--- a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-tpm2.c
+++ b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-tpm2.c
@@ -1,6 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <libcryptsetup.h>
 #include <syslog.h>
 
 #include "alloc-util.h"
diff --git a/src/cryptsetup/cryptsetup-tokens/luks2-fido2.c b/src/cryptsetup/cryptsetup-tokens/luks2-fido2.c
index c6cfdcf6ef..eeb5ca0242 100644
--- a/src/cryptsetup/cryptsetup-tokens/luks2-fido2.c
+++ b/src/cryptsetup/cryptsetup-tokens/luks2-fido2.c
@@ -1,7 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <libcryptsetup.h>
-
 #include "alloc-util.h"
 #include "cryptsetup-token-util.h"
 #include "hexdecoct.h"
diff --git a/src/cryptsetup/cryptsetup-tokens/meson.build b/src/cryptsetup/cryptsetup-tokens/meson.build
index 772c29f50f..078062d073 100644
--- a/src/cryptsetup/cryptsetup-tokens/meson.build
+++ b/src/cryptsetup/cryptsetup-tokens/meson.build
@@ -5,7 +5,10 @@ lib_cryptsetup_token_common = static_library(
         'cryptsetup-token-util.c',
         include_directories : includes,
         implicit_include_directories : false,
-        dependencies : userspace,
+        dependencies : [
+                libcryptsetup_cflags,
+                userspace,
+        ],
         link_with : libshared,
         build_by_default : false)
 
diff --git a/src/cryptsetup/meson.build b/src/cryptsetup/meson.build
index 9b7f3fa344..85f15885c0 100644
--- a/src/cryptsetup/meson.build
+++ b/src/cryptsetup/meson.build
@@ -23,11 +23,15 @@ executables += [
                         libmount_cflags,
                         libopenssl_cflags,
                         libp11kit_cflags,
+                        tpm2_cflags,
                 ],
         },
         generator_template + {
                 'name' : 'systemd-cryptsetup-generator',
                 'sources' : files('cryptsetup-generator.c'),
+                'dependencies' : [
+                        libcryptsetup_cflags,
+                ],
         },
 ]
 
diff --git a/src/dissect/meson.build b/src/dissect/meson.build
index 24943cc802..92e2305897 100644
--- a/src/dissect/meson.build
+++ b/src/dissect/meson.build
@@ -9,6 +9,9 @@ executables += [
                 'name' : 'systemd-dissect',
                 'public' : true,
                 'sources' : files('dissect.c'),
+                'dependencies' : [
+                        libarchive_cflags,
+                ],
         },
 ]
 
diff --git a/src/fuzz/meson.build b/src/fuzz/meson.build
index 65fc6896f1..10848a77e6 100644
--- a/src/fuzz/meson.build
+++ b/src/fuzz/meson.build
@@ -8,7 +8,6 @@ simple_fuzzers += files(
         'fuzz-env-file.c',
         'fuzz-hostname-setup.c',
         'fuzz-json.c',
-        'fuzz-pe-binary.c',
         'fuzz-time-util.c',
         'fuzz-udev-database.c',
         'fuzz-user-record.c',
@@ -16,6 +15,13 @@ simple_fuzzers += files(
         'fuzz-varlink-idl.c',
 )
 
+executables += [
+        fuzz_template + {
+                'sources' : files('fuzz-pe-binary.c'),
+                'dependencies' : libopenssl_cflags,
+        },
+]
+
 # The following fuzzers do not work on oss-fuzz. See #11018.
 if not want_ossfuzz
         simple_fuzzers += files('fuzz-compress.c')
diff --git a/src/growfs/meson.build b/src/growfs/meson.build
index 0fcedb19d9..7bdc329c36 100644
--- a/src/growfs/meson.build
+++ b/src/growfs/meson.build
@@ -4,6 +4,9 @@ executables += [
         libexec_template + {
                 'name' : 'systemd-growfs',
                 'sources' : files('growfs.c'),
+                'dependencies' : [
+                        libcryptsetup_cflags,
+                ],
         },
         libexec_template + {
                 'name' : 'systemd-makefs',
diff --git a/src/home/meson.build b/src/home/meson.build
index b724517ae9..2713b04635 100644
--- a/src/home/meson.build
+++ b/src/home/meson.build
@@ -75,7 +75,9 @@ executables += [
                 'objects' : ['systemd-homed'],
                 'dependencies' : [
                         libblkid_cflags,
+                        libcryptsetup_cflags,
                         libfdisk_cflags,
+                        libfido2_cflags,
                         libopenssl_cflags,
                         libp11kit_cflags,
                 ],
@@ -87,6 +89,7 @@ executables += [
                 'extract' : homectl_extract,
                 'objects' : ['systemd-homed'],
                 'dependencies' : [
+                        libfido2_cflags,
                         libopenssl_cflags,
                         libp11kit_cflags,
                 ],
diff --git a/src/imds/meson.build b/src/imds/meson.build
index a23735d100..9167600b65 100644
--- a/src/imds/meson.build
+++ b/src/imds/meson.build
@@ -10,6 +10,9 @@ executables += [
                 'public' : true,
                 'sources' : files('imdsd.c'),
                 'extract' : files('imds-util.c'),
+                'dependencies' : [
+                        libcurl_cflags,
+                ],
         },
         libexec_template + {
                 'name' : 'systemd-imds',
diff --git a/src/import/meson.build b/src/import/meson.build
index f133f276b4..e141ffb975 100644
--- a/src/import/meson.build
+++ b/src/import/meson.build
@@ -17,6 +17,10 @@ executables += [
                         'import-common.c',
                         'qcow2-util.c',
                 ),
+                'dependencies' : [
+                        libarchive_cflags,
+                        libselinux_cflags,
+                ],
         },
         libexec_template + {
                 'name' : 'systemd-pull',
@@ -30,7 +34,10 @@ executables += [
                         'pull-tar.c',
                 ),
                 'objects' : ['systemd-importd'],
-                'dependencies' : libopenssl_cflags,
+                'dependencies' : [
+                        libcurl_cflags,
+                        libopenssl_cflags,
+                ],
         },
         libexec_template + {
                 'name' : 'systemd-import',
@@ -73,6 +80,9 @@ executables += [
         test_template + {
                 'sources' : files('test-tar.c'),
                 'type' : 'manual',
+                'dependencies' : [
+                        libarchive_cflags,
+                ],
         },
         test_template + {
                 'sources' : files('test-qcow2.c'),
diff --git a/src/import/pull-common.h b/src/import/pull-common.h
index e4c0d36530..f38d4f1bae 100644
--- a/src/import/pull-common.h
+++ b/src/import/pull-common.h
@@ -1,13 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "shared-forward.h"
 #include "import-common.h"
 #include "import-util.h"
-#include "pull-job.h"
-
-typedef struct CurlGlue CurlGlue;
-typedef struct PullJob PullJob;
+#include "pull-forward.h"
 
 int pull_find_old_etags(
                 const char *url,
diff --git a/src/import/pull-forward.h b/src/import/pull-forward.h
new file mode 100644
index 0000000000..39ed1725ce
--- /dev/null
+++ b/src/import/pull-forward.h
@@ -0,0 +1,22 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include "shared-forward.h"
+
+typedef enum PullJobState PullJobState;
+
+typedef struct PullJob PullJob;
+
+typedef struct OciPull OciPull;
+typedef struct RawPull RawPull;
+typedef struct TarPull TarPull;
+
+typedef void (*PullJobFinished)(PullJob *job);
+typedef int (*PullJobOpenDisk)(PullJob *job);
+typedef int (*PullJobHeader)(PullJob *job, const char *header, size_t sz);
+typedef void (*PullJobProgress)(PullJob *job);
+typedef int (*PullJobNotFound)(PullJob *job, char **ret_new_url);
+
+typedef void (*OciPullFinished)(OciPull *pull, int error, void *userdata);
+typedef void (*RawPullFinished)(RawPull *p, int error, void *userdata);
+typedef void (*TarPullFinished)(TarPull *p, int error, void *userdata);
diff --git a/src/import/pull-job.c b/src/import/pull-job.c
index 7d83c994ff..119bb75286 100644
--- a/src/import/pull-job.c
+++ b/src/import/pull-job.c
@@ -15,7 +15,6 @@
 #include "io-util.h"
 #include "log.h"
 #include "parse-util.h"
-#include "pull-common.h"
 #include "pull-job.h"
 #include "string-util.h"
 #include "strv.h"
diff --git a/src/import/pull-job.h b/src/import/pull-job.h
index 00d001680f..2314cc2452 100644
--- a/src/import/pull-job.h
+++ b/src/import/pull-job.h
@@ -1,19 +1,10 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <curl/curl.h>
 #include <sys/stat.h>
 #include <sys/uio.h>
 
-#include "shared-forward.h"
-
-typedef struct PullJob PullJob;
-
-typedef void (*PullJobFinished)(PullJob *job);
-typedef int (*PullJobOpenDisk)(PullJob *job);
-typedef int (*PullJobHeader)(PullJob *job, const char *header, size_t sz);
-typedef void (*PullJobProgress)(PullJob *job);
-typedef int (*PullJobNotFound)(PullJob *job, char **ret_new_url);
+#include "pull-forward.h"
 
 typedef enum PullJobState {
         PULL_JOB_INIT,
diff --git a/src/import/pull-oci.c b/src/import/pull-oci.c
index b6fa71c902..a9019f19a5 100644
--- a/src/import/pull-oci.c
+++ b/src/import/pull-oci.c
@@ -28,6 +28,7 @@
 #include "pidref.h"
 #include "process-util.h"
 #include "pull-common.h"
+#include "pull-job.h"
 #include "pull-oci.h"
 #include "rm-rf.h"
 #include "set.h"
diff --git a/src/import/pull-oci.h b/src/import/pull-oci.h
index 86a37c33ec..4cf02b97e9 100644
--- a/src/import/pull-oci.h
+++ b/src/import/pull-oci.h
@@ -1,12 +1,8 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "shared-forward.h"
 #include "import-common.h"
-
-typedef struct OciPull OciPull;
-
-typedef void (*OciPullFinished)(OciPull *pull, int error, void *userdata);
+#include "pull-forward.h"
 
 int oci_pull_new(OciPull **ret, sd_event *event, const char *image_root, OciPullFinished on_finished, void *userdata);
 OciPull* oci_pull_unref(OciPull *i);
diff --git a/src/import/pull-raw.h b/src/import/pull-raw.h
index d927d927f8..d28ec644eb 100644
--- a/src/import/pull-raw.h
+++ b/src/import/pull-raw.h
@@ -1,13 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "shared-forward.h"
 #include "import-common.h"
 #include "import-util.h"
-
-typedef struct RawPull RawPull;
-
-typedef void (*RawPullFinished)(RawPull *p, int error, void *userdata);
+#include "pull-forward.h"
 
 int raw_pull_new(RawPull **ret, sd_event *event, const char *image_root, RawPullFinished on_finished, void *userdata);
 RawPull* raw_pull_unref(RawPull *p);
diff --git a/src/import/pull-tar.h b/src/import/pull-tar.h
index 39a9eacb35..bcb998b82d 100644
--- a/src/import/pull-tar.h
+++ b/src/import/pull-tar.h
@@ -1,13 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "shared-forward.h"
 #include "import-common.h"
 #include "import-util.h"
-
-typedef struct TarPull TarPull;
-
-typedef void (*TarPullFinished)(TarPull *p, int error, void *userdata);
+#include "pull-forward.h"
 
 int tar_pull_new(TarPull **ret, sd_event *event, const char *image_root, TarPullFinished on_finished, void *userdata);
 TarPull* tar_pull_unref(TarPull *p);
diff --git a/src/include/meson.build b/src/include/meson.build
index 9cf7e4dbc8..5fc8bb6a61 100644
--- a/src/include/meson.build
+++ b/src/include/meson.build
@@ -33,11 +33,6 @@ ipproto_sources = files(
         'uapi/linux/in.h',
 )
 
-# Source files that provides AUDIT_XYZ
-audit_sources = files(
-        'override/linux/audit.h',
-)
-
 # Source files that provides KEY_XYZ
 keyboard_sources = files(
         'uapi/linux/input.h',
diff --git a/src/include/override/linux/audit.h b/src/include/override/linux/audit.h
deleted file mode 100644
index abdd25b379..0000000000
--- a/src/include/override/linux/audit.h
+++ /dev/null
@@ -1,33 +0,0 @@
-/* SPDX-License-Identifier: LGPL-2.1-or-later */
-#pragma once
-
-#include_next <linux/audit.h>   /* IWYU pragma: export */
-
-#if HAVE_AUDIT
-#  include <libaudit.h>         /* IWYU pragma: export */
-#endif
-
-#include <assert.h>
-
-/* We use static_assert() directly here instead of assert_cc()
- * because if we include macro.h in this header, the invocation
- * of generate-audit_type-list.sh becomes more complex.
- */
-
-#ifndef AUDIT_SERVICE_START
-#  define AUDIT_SERVICE_START 1130 /* Service (daemon) start */
-#else
-static_assert(AUDIT_SERVICE_START == 1130, "");
-#endif
-
-#ifndef AUDIT_SERVICE_STOP
-#  define AUDIT_SERVICE_STOP 1131 /* Service (daemon) stop */
-#else
-static_assert(AUDIT_SERVICE_STOP == 1131, "");
-#endif
-
-#ifndef MAX_AUDIT_MESSAGE_LENGTH
-#  define MAX_AUDIT_MESSAGE_LENGTH 8970
-#else
-static_assert(MAX_AUDIT_MESSAGE_LENGTH == 8970, "");
-#endif
diff --git a/src/journal-remote/journal-gatewayd.c b/src/journal-remote/journal-gatewayd.c
index bb1f901d9c..2546550720 100644
--- a/src/journal-remote/journal-gatewayd.c
+++ b/src/journal-remote/journal-gatewayd.c
@@ -1,7 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include <fcntl.h>
-#include <microhttpd.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/stat.h>
diff --git a/src/journal-remote/journal-upload-journal.c b/src/journal-remote/journal-upload-journal.c
index 66cc4114f4..21974a67ed 100644
--- a/src/journal-remote/journal-upload-journal.c
+++ b/src/journal-remote/journal-upload-journal.c
@@ -1,7 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <curl/curl.h>
-
 #include "sd-daemon.h"
 #include "sd-event.h"
 #include "sd-journal.h"
diff --git a/src/journal-remote/journal-upload.h b/src/journal-remote/journal-upload.h
index 9ab0f535a4..3c857dc4b6 100644
--- a/src/journal-remote/journal-upload.h
+++ b/src/journal-remote/journal-upload.h
@@ -2,8 +2,7 @@
 
 #pragma once
 
-#include <curl/curl.h>
-
+#include "curl-util.h"
 #include "shared-forward.h"
 #include "journal-compression-util.h"
 
diff --git a/src/journal-remote/meson.build b/src/journal-remote/meson.build
index 22ac8703b5..1338a3e673 100644
--- a/src/journal-remote/meson.build
+++ b/src/journal-remote/meson.build
@@ -59,7 +59,10 @@ executables += [
                 'sources' : systemd_journal_upload_sources,
                 'extract' : systemd_journal_upload_extract_sources,
                 'objects' : ['systemd-journal-remote'],
-                'dependencies' : common_deps,
+                'dependencies' : [
+                        common_deps,
+                        libcurl_cflags,
+                ],
         },
         test_template + {
                 'sources' : files('test-journal-header-util.c'),
diff --git a/src/libsystemd/sd-journal/audit-type.c b/src/journal/audit-type.c
similarity index 100%
rename from src/libsystemd/sd-journal/audit-type.c
rename to src/journal/audit-type.c
diff --git a/src/libsystemd/sd-journal/audit-type.h b/src/journal/audit-type.h
similarity index 100%
rename from src/libsystemd/sd-journal/audit-type.h
rename to src/journal/audit-type.h
diff --git a/src/libsystemd/sd-journal/audit_type-to-name.awk b/src/journal/audit_type-to-name.awk
similarity index 61%
rename from src/libsystemd/sd-journal/audit_type-to-name.awk
rename to src/journal/audit_type-to-name.awk
index 5dbba45af1..879156fd2f 100644
--- a/src/libsystemd/sd-journal/audit_type-to-name.awk
+++ b/src/journal/audit_type-to-name.awk
@@ -1,6 +1,13 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
 BEGIN{
+        print "#if HAVE_AUDIT"
+        print "#  ifndef SYSTEMD_CFLAGS_MARKER_LIBAUDIT"
+        print "#    error \"missing libaudit_cflags in meson dependency.\""
+        print "#  endif"
+        print "#  include <libaudit.h>"
+        print "#endif"
+        print ""
         print "#include <linux/audit.h>"
         print ""
         print "#include \"audit-type.h\""
diff --git a/src/libsystemd/sd-journal/generate-audit_type-list.sh b/src/journal/generate-audit_type-list.sh
similarity index 100%
rename from src/libsystemd/sd-journal/generate-audit_type-list.sh
rename to src/journal/generate-audit_type-list.sh
diff --git a/src/journal/journald-manager.c b/src/journal/journald-manager.c
index 68f95ea967..be3532f1ed 100644
--- a/src/journal/journald-manager.c
+++ b/src/journal/journald-manager.c
@@ -1,6 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <linux/audit.h>
 #include <linux/sockios.h>
 #include <sys/stat.h>
 #include <sys/ioctl.h>
@@ -47,6 +46,7 @@
 #include "journald-sync.h"
 #include "journald-syslog.h"
 #include "journald-varlink.h"
+#include "libaudit-util.h"
 #include "log.h"
 #include "log-ratelimit.h"
 #include "memory-util.h"
diff --git a/src/journal/meson.build b/src/journal/meson.build
index e39381f03f..41561deb8b 100644
--- a/src/journal/meson.build
+++ b/src/journal/meson.build
@@ -4,6 +4,7 @@ systemd_journald_sources = files(
         'journald.c',
 )
 systemd_journald_extract_sources = files(
+        'audit-type.c',
         'journald-audit.c',
         'journald-client.c',
         'journald-config.c',
@@ -29,6 +30,31 @@ journald_gperf_c = custom_target(
 generated_sources += journald_gperf_c
 systemd_journald_extract_sources += journald_gperf_c
 
+generate_audit_type_list = files('generate-audit_type-list.sh')
+generate_audit_type_command = [env, 'bash', generate_audit_type_list, cpp]
+if libaudit.found()
+        generate_audit_type_command += [
+                '-include', 'libaudit.h',
+                '-I' + libaudit.get_variable('includedir'),
+        ]
+endif
+generate_audit_type_command += system_include_args
+
+audit_type_list_txt = custom_target(
+        input : [generate_audit_type_list],
+        output : 'audit_type-list.txt',
+        command : generate_audit_type_command,
+        capture : true)
+
+audit_type_to_name = custom_target(
+        input : ['audit_type-to-name.awk', audit_type_list_txt],
+        output : 'audit_type-to-name.inc',
+        command : [awk, '-f', '@INPUT0@', '@INPUT1@'],
+        capture : true)
+
+generated_sources += audit_type_to_name
+systemd_journald_extract_sources += audit_type_to_name
+
 journalctl_sources = files(
         'journalctl.c',
         'journalctl-authenticate.c',
@@ -69,7 +95,10 @@ executables += [
                 'sources' : systemd_journald_sources,
                 'extract' : systemd_journald_extract_sources,
                 'dependencies' : [
+                        libacl_cflags,
+                        libaudit_cflags,
                         liblz4_cflags,
+                        libpcre2_cflags,
                         libselinux_cflags,
                         libxz_cflags,
                         libzstd_cflags,
@@ -80,6 +109,9 @@ executables += [
                 'public' : true,
                 'conditions' : ['HAVE_QRENCODE'],
                 'sources' : files('bsod.c'),
+                'dependencies' : [
+                        libqrencode_cflags,
+                ],
         },
         executable_template + {
                 'name' : 'systemd-cat',
@@ -95,10 +127,14 @@ executables += [
                 'dependencies' : [
                         liblz4_cflags,
                         libopenssl_cflags,
+                        libpcre2_cflags,
                         libxz_cflags,
                         libzstd_cflags,
                 ],
         },
+        journal_test_template + {
+                'sources' : files('test-audit-type.c'),
+        },
         journal_test_template + {
                 'sources' : files('test-journald-config.c'),
                 'dependencies' : [
diff --git a/src/libsystemd/sd-journal/test-audit-type.c b/src/journal/test-audit-type.c
similarity index 100%
rename from src/libsystemd/sd-journal/test-audit-type.c
rename to src/journal/test-audit-type.c
diff --git a/src/libsystemd/meson.build b/src/libsystemd/meson.build
index d1797722a4..cd3821bb8d 100644
--- a/src/libsystemd/meson.build
+++ b/src/libsystemd/meson.build
@@ -1,7 +1,6 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
 sd_journal_sources = files(
-        'sd-journal/audit-type.c',
         'sd-journal/catalog.c',
         'sd-journal/journal-authenticate-internal.c',
         'sd-journal/journal-file.c',
@@ -13,11 +12,6 @@ sd_journal_sources = files(
         'sd-journal/sd-journal.c',
 )
 
-subdir('sd-journal')
-
-generated_sources += audit_type_to_name
-sd_journal_sources += audit_type_to_name
-
 ############################################################
 
 sd_id128_sources = files(
@@ -197,7 +191,6 @@ simple_tests += files(
         'sd-future/test-fiber-ops.c',
         'sd-hwdb/test-sd-hwdb.c',
         'sd-id128/test-id128.c',
-        'sd-journal/test-audit-type.c',
         'sd-journal/test-catalog.c',
         'sd-journal/test-journal-file.c',
         'sd-journal/test-journal-flush.c',
@@ -233,9 +226,7 @@ libsystemd_tests += [
                 'sources' : files('sd-bus/test-bus-marshal.c'),
                 'dependencies' : [
                         libdbus_cflags,
-                        libgio_cflags,
                         libglib_cflags,
-                        libgobject_cflags,
                 ],
         },
         {
diff --git a/src/libsystemd/sd-bus/test-bus-marshal.c b/src/libsystemd/sd-bus/test-bus-marshal.c
index 05074fd92b..064b76d3e0 100644
--- a/src/libsystemd/sd-bus/test-bus-marshal.c
+++ b/src/libsystemd/sd-bus/test-bus-marshal.c
@@ -5,12 +5,18 @@
 #include "macro.h"
 
 #if HAVE_GLIB
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBGLIB
+#  error "missing libglib_cflags in meson dependency."
+#endif
 DISABLE_WARNING_FORMAT_NONLITERAL
 #include <gio/gio.h> /* NOLINT */
 REENABLE_WARNING
 #endif
 
 #if HAVE_DBUS
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBDBUS
+#  error "missing libdbus_cflags in meson dependency."
+#endif
 #include <dbus/dbus.h>
 #endif
 
diff --git a/src/libsystemd/sd-journal/meson.build b/src/libsystemd/sd-journal/meson.build
deleted file mode 100644
index 61ddf66b59..0000000000
--- a/src/libsystemd/sd-journal/meson.build
+++ /dev/null
@@ -1,26 +0,0 @@
-# SPDX-License-Identifier: LGPL-2.1-or-later
-
-# We're generating a header file here intended to be included
-# by audit-type.c. To make that work, we have to add the generated
-# header file's directory to the include directories for libsystemd.
-# In meson, adding include directories is done via include_directories(),
-# which always adds two include directories for each argument, one relative to
-# the source directory and one relative to the build directory. We don't
-# want to add src/libsystemd to the include directories, yet custom_target()
-# does not allow path segments in its output argument, so to make sure the
-# generated header is written to src/libsystemd/sd-journal in the build directory,
-# the custom_target() has to be defined here in src/libsystemd/sd-journal
-# in the source directory.
-
-generate_audit_type_list = files('generate-audit_type-list.sh')
-audit_type_list_txt = custom_target(
-        input : [generate_audit_type_list, audit_sources],
-        output : 'audit_type-list.txt',
-        command : [env, 'bash', generate_audit_type_list, cpp, system_include_args],
-        capture : true)
-
-audit_type_to_name = custom_target(
-        input : ['audit_type-to-name.awk', audit_type_list_txt],
-        output : 'audit_type-to-name.inc',
-        command : [awk, '-f', '@INPUT0@', '@INPUT1@'],
-        capture : true)
diff --git a/src/locale/xkbcommon-util.h b/src/locale/xkbcommon-util.h
index 1a709ae50c..e441e9d89b 100644
--- a/src/locale/xkbcommon-util.h
+++ b/src/locale/xkbcommon-util.h
@@ -5,6 +5,10 @@
 #include "shared-forward.h"
 
 #if HAVE_XKBCOMMON
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBXKBCOMMON
+#  error "missing libxkbcommon_cflags in meson dependency."
+#endif
+
 #include <xkbcommon/xkbcommon.h>
 
 extern DLSYM_PROTOTYPE(xkb_context_new);
diff --git a/src/login/meson.build b/src/login/meson.build
index 44325ccd7c..effb44c3a8 100644
--- a/src/login/meson.build
+++ b/src/login/meson.build
@@ -48,6 +48,9 @@ executables += [
                 'dbus' : true,
                 'sources' : systemd_logind_sources,
                 'extract' : systemd_logind_extract_sources,
+                'dependencies' : [
+                        libacl_cflags,
+                ],
         },
         executable_template + {
                 'name' : 'loginctl',
diff --git a/src/measure/meson.build b/src/measure/meson.build
index ff777dc5d9..3dd793e8c3 100644
--- a/src/measure/meson.build
+++ b/src/measure/meson.build
@@ -9,6 +9,9 @@ executables += [
                         'HAVE_TPM2',
                 ],
                 'sources' : files('measure-tool.c'),
-                'dependencies' : libopenssl_cflags,
+                'dependencies' : [
+                        libopenssl_cflags,
+                        tpm2_cflags,
+                ],
         },
 ]
diff --git a/src/network/meson.build b/src/network/meson.build
index 110af9511c..b620e512df 100644
--- a/src/network/meson.build
+++ b/src/network/meson.build
@@ -204,9 +204,12 @@ executables += [
                         libsystemd_network,
                         networkd_link_with,
                 ],
+                'dependencies' : [
+                        libbpf_cflags,
+                ],
                 'bpf_programs': [
                         'sysctl-monitor',
-                ]
+                ],
         },
         libexec_template + {
                 'name' : 'systemd-networkd-wait-online',
@@ -225,6 +228,9 @@ executables += [
                         libsystemd_network,
                         networkd_link_with,
                 ],
+                'dependencies' : [
+                        libselinux_cflags,
+                ],
         },
         libexec_template + {
                 'name' : 'systemd-network-generator',
diff --git a/src/nsresourced/meson.build b/src/nsresourced/meson.build
index 1654e1766b..2037d06bc8 100644
--- a/src/nsresourced/meson.build
+++ b/src/nsresourced/meson.build
@@ -24,6 +24,9 @@ executables += [
                 'name' : 'systemd-nsresourced',
                 'sources' : systemd_nsresourced_sources,
                 'extract' : systemd_nsresourced_extract_sources,
+                'dependencies' : [
+                        libbpf_cflags,
+                ],
                 'bpf_programs': ['userns-restrict'],
         },
         libexec_template + {
diff --git a/src/pcrextend/meson.build b/src/pcrextend/meson.build
index f2f5f3b46e..ced1be5a90 100644
--- a/src/pcrextend/meson.build
+++ b/src/pcrextend/meson.build
@@ -12,7 +12,7 @@ executables += [
                 'sources' : files('pcrextend.c'),
                 'dependencies' : [
                         libopenssl_cflags,
-                        tpm2,
+                        tpm2_cflags,
                 ],
         },
 ]
diff --git a/src/pcrlock/meson.build b/src/pcrlock/meson.build
index dbe816402d..d93a4f6069 100644
--- a/src/pcrlock/meson.build
+++ b/src/pcrlock/meson.build
@@ -13,7 +13,7 @@ executables += [
                 ),
                 'dependencies' : [
                         libopenssl_cflags,
-                        tpm2,
+                        tpm2_cflags,
                 ],
                 'public' : true,
         },
diff --git a/src/repart/meson.build b/src/repart/meson.build
index 6d3278c3ca..721fe73b9a 100644
--- a/src/repart/meson.build
+++ b/src/repart/meson.build
@@ -15,9 +15,11 @@ executables += [
                 ),
                 'dependencies' : [
                         libblkid_cflags,
+                        libcryptsetup_cflags,
                         libfdisk_cflags,
                         libmount_cflags,
                         libopenssl_cflags,
+                        tpm2_cflags,
                 ],
         },
         executable_template + {
@@ -32,9 +34,11 @@ executables += [
                 ],
                 'dependencies' : [
                         libblkid_cflags,
+                        libcryptsetup_cflags,
                         libfdisk_cflags,
                         libmount_cflags,
                         libopenssl_cflags,
+                        tpm2_cflags,
                 ],
         },
 ]
diff --git a/src/report/meson.build b/src/report/meson.build
index d0a316c689..8a4716ec21 100644
--- a/src/report/meson.build
+++ b/src/report/meson.build
@@ -10,6 +10,9 @@ executables += [
                         'report-sign.c',
                         'report-upload.c',
                 ),
+                'dependencies' : [
+                        libcurl_cflags,
+                ],
         },
 
         libexec_template + {
diff --git a/src/sbsign/authenticode.h b/src/sbsign/authenticode.h
index c076fe3624..236435a7e9 100644
--- a/src/sbsign/authenticode.h
+++ b/src/sbsign/authenticode.h
@@ -1,6 +1,10 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBOPENSSL
+#  error "missing libopenssl_cflags in meson dependency."
+#endif
+
 #include <openssl/asn1.h>
 
 #include "shared-forward.h"
diff --git a/src/shared/acl-util.h b/src/shared/acl-util.h
index 981f43a8cc..2b9ac81736 100644
--- a/src/shared/acl-util.h
+++ b/src/shared/acl-util.h
@@ -6,6 +6,10 @@
 #include "shared-forward.h"
 
 #if HAVE_ACL
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBACL
+#  error "missing libacl_cflags in meson dependency."
+#endif
+
 #include <acl/libacl.h> /* IWYU pragma: export */
 #include <sys/acl.h>    /* IWYU pragma: export */
 
diff --git a/src/shared/apparmor-util.h b/src/shared/apparmor-util.h
index e87ba84504..2d47a341cb 100644
--- a/src/shared/apparmor-util.h
+++ b/src/shared/apparmor-util.h
@@ -4,6 +4,10 @@
 #include "shared-forward.h"
 
 #if HAVE_APPARMOR
+#  ifndef SYSTEMD_CFLAGS_MARKER_LIBAPPARMOR
+#    error "missing libapparmor_cflags in meson dependency."
+#  endif
+
 #  include <sys/apparmor.h>
 
 #  include "dlfcn-util.h"
diff --git a/src/shared/blkid-util.h b/src/shared/blkid-util.h
index c211bbf3ab..97356477fa 100644
--- a/src/shared/blkid-util.h
+++ b/src/shared/blkid-util.h
@@ -6,6 +6,9 @@
 #include "shared-forward.h"
 
 #if HAVE_BLKID
+#  ifndef SYSTEMD_CFLAGS_MARKER_LIBBLKID
+#    error "missing libblkid_cflags in meson dependency."
+#  endif
 
 #include <blkid.h>
 
diff --git a/src/shared/bpf-link.h b/src/shared/bpf-link.h
index 4de95eb2e1..b5be07865d 100644
--- a/src/shared/bpf-link.h
+++ b/src/shared/bpf-link.h
@@ -2,6 +2,9 @@
 #pragma once
 
 #if HAVE_LIBBPF
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBBPF
+#  error "missing libbpf_cflags in meson dependency."
+#endif
 
 #include <bpf/libbpf.h>
 
diff --git a/src/shared/bpf-util.h b/src/shared/bpf-util.h
index faf7349b8a..6c2e7a2c98 100644
--- a/src/shared/bpf-util.h
+++ b/src/shared/bpf-util.h
@@ -6,6 +6,9 @@
 #include "sd-dlopen.h"
 
 #if HAVE_LIBBPF
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBBPF
+#  error "missing libbpf_cflags in meson dependency."
+#endif
 
 #include <bpf/bpf.h>    /* IWYU pragma: export */
 #include <bpf/libbpf.h> /* IWYU pragma: export */
diff --git a/src/shared/crypto-util.h b/src/shared/crypto-util.h
index 42a3f2f8c0..9927dfb5c7 100644
--- a/src/shared/crypto-util.h
+++ b/src/shared/crypto-util.h
@@ -33,6 +33,10 @@ int dlopen_libcrypto(int log_level);
 #define X509_FINGERPRINT_SIZE SHA256_DIGEST_SIZE
 
 #if HAVE_OPENSSL
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBOPENSSL
+#  error "missing libopenssl_cflags in meson dependency."
+#endif
+
 #define LIBCRYPTO_NOTE(priority)                                        \
         SD_ELF_NOTE_DLOPEN("libcrypto",                                 \
                            "Support for cryptographic operations",      \
diff --git a/src/shared/cryptsetup-util.h b/src/shared/cryptsetup-util.h
index 1b3ab8b960..6e9c95aa9e 100644
--- a/src/shared/cryptsetup-util.h
+++ b/src/shared/cryptsetup-util.h
@@ -7,6 +7,10 @@
 #include "shared-forward.h"
 
 #if HAVE_LIBCRYPTSETUP
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBCRYPTSETUP
+#  error "missing libcryptsetup_cflags in meson dependency."
+#endif
+
 #include <libcryptsetup.h> /* IWYU pragma: export */
 
 /* Available since libcryptsetup 2.7. Always redeclare so DLSYM_PROTOTYPE's typeof() resolves on older
diff --git a/src/shared/curl-util.h b/src/shared/curl-util.h
index 33bf3684c9..a010cefac1 100644
--- a/src/shared/curl-util.h
+++ b/src/shared/curl-util.h
@@ -6,6 +6,10 @@
 #include "shared-forward.h"
 
 #if HAVE_LIBCURL
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBCURL
+#  error "missing libcurl_cflags in meson dependency."
+#endif
+
 #include <curl/curl.h>            /* IWYU pragma: export */
 
 #include "dlfcn-util.h"
diff --git a/src/shared/elf-util.c b/src/shared/elf-util.c
index 2210ab39f1..5e40541ffc 100644
--- a/src/shared/elf-util.c
+++ b/src/shared/elf-util.c
@@ -1,6 +1,10 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #if HAVE_ELFUTILS
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBELF
+#  error "missing libelf_cflags in meson dependency."
+#endif
+
 #include <dwarf.h>
 #include <elfutils/libdwelf.h>
 #include <elfutils/libdwfl.h>
diff --git a/src/shared/fdisk-util.h b/src/shared/fdisk-util.h
index 367c6cd051..acdbd7c741 100644
--- a/src/shared/fdisk-util.h
+++ b/src/shared/fdisk-util.h
@@ -6,6 +6,9 @@
 #include "shared-forward.h"
 
 #if HAVE_LIBFDISK
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBFDISK
+#  error "missing libfdisk_cflags in meson dependency."
+#endif
 
 #include <libfdisk.h> /* IWYU pragma: export */
 
diff --git a/src/shared/gnutls-util.h b/src/shared/gnutls-util.h
index a110b437c3..dd0f1d55ac 100644
--- a/src/shared/gnutls-util.h
+++ b/src/shared/gnutls-util.h
@@ -6,6 +6,10 @@
 int dlopen_gnutls(int log_level);
 
 #if HAVE_GNUTLS
+#  ifndef SYSTEMD_CFLAGS_MARKER_LIBGNUTLS
+#    error "missing libgnutls_cflags in meson dependency."
+#  endif
+
 #  include <gnutls/gnutls.h>    /* IWYU pragma: export */
 #  include <gnutls/x509.h>      /* IWYU pragma: export */
 
diff --git a/src/shared/idn-util.h b/src/shared/idn-util.h
index 9bed27140f..0f3db74c63 100644
--- a/src/shared/idn-util.h
+++ b/src/shared/idn-util.h
@@ -6,6 +6,10 @@
 #include "shared-forward.h"
 
 #if HAVE_LIBIDN2
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBIDN2
+#  error "missing libidn2_cflags in meson dependency."
+#endif
+
 #include <idn2.h>
 
 #include "dlfcn-util.h"
diff --git a/src/shared/libarchive-util.h b/src/shared/libarchive-util.h
index afaf371200..71b4d66d42 100644
--- a/src/shared/libarchive-util.h
+++ b/src/shared/libarchive-util.h
@@ -6,6 +6,10 @@
 #include "shared-forward.h"
 
 #if HAVE_LIBARCHIVE
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBARCHIVE
+#  error "missing libarchive_cflags in meson dependency."
+#endif
+
 #include <archive.h>            /* IWYU pragma: export */
 #include <archive_entry.h>      /* IWYU pragma: export */
 
diff --git a/src/shared/libaudit-util.h b/src/shared/libaudit-util.h
index 8bb05a2fbd..d16e25df67 100644
--- a/src/shared/libaudit-util.h
+++ b/src/shared/libaudit-util.h
@@ -6,6 +6,10 @@
 int dlopen_libaudit(int log_level);
 
 #if HAVE_AUDIT
+#  ifndef SYSTEMD_CFLAGS_MARKER_LIBAUDIT
+#    error "missing libaudit_cflags in meson dependency."
+#  endif
+
 #  include <libaudit.h>         /* IWYU pragma: export */
 
 #  include "dlfcn-util.h"
@@ -15,6 +19,26 @@ extern DLSYM_PROTOTYPE(audit_log_user_avc_message);
 extern DLSYM_PROTOTYPE(audit_log_user_comm_message);
 #endif
 
+/* libaudit.h defines these constants.
+ * Define them here too so they can be used even when libaudit.h is unavailable. */
+#ifndef AUDIT_SERVICE_START
+#  define AUDIT_SERVICE_START 1130 /* Service (daemon) start */
+#else
+assert_cc(AUDIT_SERVICE_START == 1130);
+#endif
+
+#ifndef AUDIT_SERVICE_STOP
+#  define AUDIT_SERVICE_STOP 1131 /* Service (daemon) stop */
+#else
+assert_cc(AUDIT_SERVICE_STOP == 1131);
+#endif
+
+#ifndef MAX_AUDIT_MESSAGE_LENGTH
+#  define MAX_AUDIT_MESSAGE_LENGTH 8970
+#else
+assert_cc(MAX_AUDIT_MESSAGE_LENGTH == 8970);
+#endif
+
 bool use_audit(void);
 
 int close_audit_fd(int fd);
diff --git a/src/shared/libcrypt-util.c b/src/shared/libcrypt-util.c
index d9710566e6..106d7688fe 100644
--- a/src/shared/libcrypt-util.c
+++ b/src/shared/libcrypt-util.c
@@ -1,6 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #if HAVE_LIBCRYPT
+#  ifndef SYSTEMD_CFLAGS_MARKER_LIBCRYPT
+#    error "missing libcrypt_cflags in meson dependency."
+#  endif
 #  include <crypt.h>
 #endif
 
diff --git a/src/shared/libfido2-util.h b/src/shared/libfido2-util.h
index 12a0201332..82705a7f23 100644
--- a/src/shared/libfido2-util.h
+++ b/src/shared/libfido2-util.h
@@ -19,6 +19,10 @@ typedef enum Fido2EnrollFlags {
 int dlopen_libfido2(int log_level);
 
 #if HAVE_LIBFIDO2
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBFIDO2
+#  error "missing libfido2_cflags in meson dependency."
+#endif
+
 #include <fido.h>
 
 #include "dlfcn-util.h"
diff --git a/src/shared/libmount-util.h b/src/shared/libmount-util.h
index 44e58ec932..3afdb97378 100644
--- a/src/shared/libmount-util.h
+++ b/src/shared/libmount-util.h
@@ -6,6 +6,9 @@
 #include "shared-forward.h"
 
 #if HAVE_LIBMOUNT
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBMOUNT
+#  error "missing libmount_cflags in meson dependency."
+#endif
 
 /* This needs to be after sys/mount.h */
 #include <libmount.h> /* IWYU pragma: export */
diff --git a/src/shared/meson.build b/src/shared/meson.build
index 6d62a7ddce..466d86bb6f 100644
--- a/src/shared/meson.build
+++ b/src/shared/meson.build
@@ -406,7 +406,6 @@ libshared_deps = [libacl_cflags,
                   libcrypt_cflags,
                   libcryptsetup_cflags,
                   libcurl_cflags,
-                  libdw_cflags,
                   libelf_cflags,
                   libfdisk_cflags,
                   libfido2_cflags,
diff --git a/src/shared/microhttpd-util.h b/src/shared/microhttpd-util.h
index 39b2b9267b..c430f9e3d1 100644
--- a/src/shared/microhttpd-util.h
+++ b/src/shared/microhttpd-util.h
@@ -8,6 +8,10 @@
 int dlopen_microhttpd(int log_level);
 
 #if HAVE_MICROHTTPD
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBMICROHTTPD
+#  error "missing libmicrohttpd_cflags in meson dependency."
+#endif
+
 #define MICROHTTPD_NOTE(priority)                                       \
         SD_ELF_NOTE_DLOPEN("microhttpd",                                \
                            "Support for embedded HTTP server via libmicrohttpd", \
diff --git a/src/shared/module-util.h b/src/shared/module-util.h
index 730e14c31b..59d2f3b1f1 100644
--- a/src/shared/module-util.h
+++ b/src/shared/module-util.h
@@ -6,6 +6,9 @@
 #include "shared-forward.h"
 
 #if HAVE_KMOD
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBKMOD
+#  error "missing libkmod_cflags in meson dependency."
+#endif
 
 #include <libkmod.h> /* IWYU pragma: export */
 
diff --git a/src/shared/pam-util.h b/src/shared/pam-util.h
index 408c371e8d..41591a4d36 100644
--- a/src/shared/pam-util.h
+++ b/src/shared/pam-util.h
@@ -6,6 +6,10 @@
 #include "shared-forward.h"
 
 #if HAVE_PAM
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBPAM
+#  error "missing libpam_cflags in meson dependency."
+#endif
+
 #include <security/pam_appl.h>
 #include <security/pam_ext.h>
 #include <security/pam_modules.h>       /* IWYU pragma: export */
diff --git a/src/shared/password-quality-util-passwdqc.c b/src/shared/password-quality-util-passwdqc.c
index f32245d344..8d762f7e5c 100644
--- a/src/shared/password-quality-util-passwdqc.c
+++ b/src/shared/password-quality-util-passwdqc.c
@@ -6,6 +6,9 @@
 #include "log.h"                 /* IWYU pragma: keep */
 
 #if HAVE_PASSWDQC
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBPWQUALITY
+#  error "missing libpwquality_cflags in meson dependency."
+#endif
 
 #include <passwdqc.h>
 
diff --git a/src/shared/password-quality-util-pwquality.c b/src/shared/password-quality-util-pwquality.c
index 34d9b1aa16..9952c4d195 100644
--- a/src/shared/password-quality-util-pwquality.c
+++ b/src/shared/password-quality-util-pwquality.c
@@ -6,6 +6,9 @@
 #include "log.h"
 
 #if HAVE_PWQUALITY
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBPWQUALITY
+#  error "missing libpwquality_cflags in meson dependency."
+#endif
 
 #include <pwquality.h>
 #include <stdio.h>
diff --git a/src/shared/pcre2-util.h b/src/shared/pcre2-util.h
index ba8827fb07..6b24dc4982 100644
--- a/src/shared/pcre2-util.h
+++ b/src/shared/pcre2-util.h
@@ -4,6 +4,9 @@
 #include "shared-forward.h"
 
 #if HAVE_PCRE2
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBPCRE2
+#  error "missing libpcre2_cflags in meson dependency."
+#endif
 
 #include "dlfcn-util.h"
 
diff --git a/src/shared/pkcs11-util.c b/src/shared/pkcs11-util.c
index 60235fa3e0..6002c2e0af 100644
--- a/src/shared/pkcs11-util.c
+++ b/src/shared/pkcs11-util.c
@@ -1,9 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#if HAVE_OPENSSL
-#  include <openssl/core_names.h>
-#endif
-
 #include "sd-dlopen.h"
 
 #include "alloc-util.h"
diff --git a/src/shared/pkcs11-util.h b/src/shared/pkcs11-util.h
index f4599a50f1..141fd29c33 100644
--- a/src/shared/pkcs11-util.h
+++ b/src/shared/pkcs11-util.h
@@ -2,6 +2,9 @@
 #pragma once
 
 #if HAVE_P11KIT
+#  ifndef SYSTEMD_CFLAGS_MARKER_LIBP11KIT
+#    error "missing libp11kit_cflags in meson dependency."
+#  endif
 #  include <p11-kit/p11-kit.h>  /* IWYU pragma: export */
 #  include <p11-kit/uri.h>      /* IWYU pragma: export */
 #endif
diff --git a/src/shared/qrcode-util.c b/src/shared/qrcode-util.c
index 44d674ba6a..a5bf75f889 100644
--- a/src/shared/qrcode-util.c
+++ b/src/shared/qrcode-util.c
@@ -3,6 +3,9 @@
 #include "qrcode-util.h"
 
 #if HAVE_QRENCODE
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBQRENCODE
+#  error "missing libqrencode_cflags in meson dependency."
+#endif
 #include <qrencode.h>
 #endif
 #include <stdio.h>
diff --git a/src/shared/reboot-util.c b/src/shared/reboot-util.c
index bd04fee342..758b7a2600 100644
--- a/src/shared/reboot-util.c
+++ b/src/shared/reboot-util.c
@@ -5,6 +5,10 @@
 #include <unistd.h>
 
 #if HAVE_XENCTRL
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBXENCTRL
+#  error "missing libxenctrl_cflags in meson dependency."
+#endif
+
 #include <sys/ioctl.h>
 #include <sys/mman.h>
 
diff --git a/src/shared/seccomp-util.h b/src/shared/seccomp-util.h
index 89dcaf5ca7..2bcb2d935b 100644
--- a/src/shared/seccomp-util.h
+++ b/src/shared/seccomp-util.h
@@ -7,6 +7,10 @@
 #include "shared-forward.h"
 
 #if HAVE_SECCOMP
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBSECCOMP
+#  error "missing libseccomp_cflags in meson dependency."
+#endif
+
 #include <seccomp.h> /* IWYU pragma: export */
 
 #include "dlfcn-util.h"
diff --git a/src/shared/selinux-util.h b/src/shared/selinux-util.h
index 98cfb6bbe4..3cc48dd3ac 100644
--- a/src/shared/selinux-util.h
+++ b/src/shared/selinux-util.h
@@ -8,6 +8,10 @@
 #include "shared-forward.h"
 
 #if HAVE_SELINUX
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBSELINUX
+#  error "missing libselinux_cflags in meson dependency."
+#endif
+
 #include <selinux/avc.h>
 #include <selinux/label.h>
 #include <selinux/context.h>
diff --git a/src/shared/ssl-util.h b/src/shared/ssl-util.h
index 857d4b5e17..3a9a4084da 100644
--- a/src/shared/ssl-util.h
+++ b/src/shared/ssl-util.h
@@ -8,6 +8,10 @@
 int dlopen_libssl(int log_level);
 
 #if HAVE_OPENSSL
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBOPENSSL
+#  error "missing libopenssl_cflags in meson dependency."
+#endif
+
 #define LIBSSL_NOTE(priority)                                           \
         SD_ELF_NOTE_DLOPEN("libssl",                                    \
                            "Support for TLS",                           \
diff --git a/src/shared/tpm2-util.h b/src/shared/tpm2-util.h
index eb910b1e84..88098acac8 100644
--- a/src/shared/tpm2-util.h
+++ b/src/shared/tpm2-util.h
@@ -50,6 +50,10 @@ static inline bool TPM2_PCR_MASK_VALID(uint32_t pcr_mask) {
 int dlopen_tpm2(int log_level);
 
 #if HAVE_TPM2
+#ifndef SYSTEMD_CFLAGS_MARKER_TPM2
+#  error "missing tpm2_cflags in meson dependency."
+#endif
+
 #define TPM2_ESYS_NOTE(priority) \
         SD_ELF_NOTE_DLOPEN("tpm", "Support for TPM", priority, "libtss2-esys.so.0")
 #define TPM2_RC_NOTE(priority) \
diff --git a/src/sysext/meson.build b/src/sysext/meson.build
index 75d06163c0..2df28f4398 100644
--- a/src/sysext/meson.build
+++ b/src/sysext/meson.build
@@ -10,6 +10,7 @@ executables += [
                         libblkid_cflags,
                         libcryptsetup_cflags,
                         libmount_cflags,
+                        libselinux_cflags,
                 ],
         },
 ]
diff --git a/src/systemctl/meson.build b/src/systemctl/meson.build
index 882704c9d7..c287f8a490 100644
--- a/src/systemctl/meson.build
+++ b/src/systemctl/meson.build
@@ -65,6 +65,9 @@ executables += [
                 'sources' : files('fuzz-systemctl-parse-argv.c'),
                 'objects' : ['systemctl'],
                 'link_with' : systemctl_link_with,
+                'dependencies' : [
+                        libselinux_cflags,
+                ],
         },
 ]
 
diff --git a/src/test/gcrypt-util.h b/src/test/gcrypt-util.h
index 0340488697..37eb3f5b61 100644
--- a/src/test/gcrypt-util.h
+++ b/src/test/gcrypt-util.h
@@ -11,6 +11,10 @@ int dlopen_gcrypt(int log_level);
 int initialize_libgcrypt(bool secmem);
 
 #if HAVE_GCRYPT
+#ifndef SYSTEMD_CFLAGS_MARKER_LIBGCRYPT
+#  error "missing libgcrypt_cflags in meson dependency."
+#endif
+
 #define GCRYPT_NOTE(priority)                                           \
         SD_ELF_NOTE_DLOPEN("gcrypt",                                    \
                            "Support for journald forward-sealing",      \
diff --git a/src/test/meson.build b/src/test/meson.build
index c90235e078..d7353ce8e2 100644
--- a/src/test/meson.build
+++ b/src/test/meson.build
@@ -79,13 +79,11 @@ simple_tests += files(
         'test-clock.c',
         'test-color-util.c',
         'test-compare-operator.c',
-        'test-condition.c',
         'test-conf-files.c',
         'test-conf-parser.c',
         'test-copy.c',
         'test-coredump-util.c',
         'test-cpu-set-util.c',
-        'test-creds.c',
         'test-daemon.c',
         'test-data-fd-util.c',
         'test-date.c',
@@ -170,7 +168,6 @@ simple_tests += files(
         'test-parse-util.c',
         'test-path-lookup.c',
         'test-path-util.c',
-        'test-pe-binary.c',
         'test-percent-util.c',
         'test-pidref.c',
         'test-pressure.c',
@@ -246,6 +243,7 @@ executables += [
         test_template + {
                 'sources' : files('test-acl-util.c'),
                 'conditions' : ['HAVE_ACL'],
+                'dependencies' : libacl_cflags,
         },
         test_template + {
                 'sources' : files('test-af-list.c') +
@@ -280,6 +278,14 @@ executables += [
                 'sources' : files('test-compress.c'),
                 'link_with' : [libshared],
         },
+        test_template + {
+                'sources' : files('test-condition.c'),
+                'dependencies' : [
+                        libapparmor_cflags,
+                        libaudit_cflags,
+                        libselinux_cflags,
+                ],
+        },
         test_template + {
                 'sources' : files('test-coredump-stacktrace.c'),
                 'type' : 'manual',
@@ -291,6 +297,10 @@ executables += [
                 'override_options' : ['b_sanitize=none', 'strip=false', 'debug=true'],
                 'c_args' : ['-fno-sanitize=all', '-fno-optimize-sibling-calls', '-O1'],
         },
+        test_template + {
+                'sources' : files('test-creds.c'),
+                'dependencies' : tpm2_cflags,
+        },
         test_template + {
                 'sources' : files('test-crypto-util.c'),
                 'dependencies' : libopenssl_cflags,
@@ -306,15 +316,29 @@ executables += [
                         'gcrypt-util.c',
                 ),
                 'dependencies' : [
+                        libacl_cflags,
+                        libapparmor_cflags,
+                        libarchive_cflags,
+                        libaudit_cflags,
                         libblkid_cflags,
+                        libbpf_cflags,
+                        libcryptsetup_cflags,
+                        libcurl_cflags,
                         libfdisk_cflags,
+                        libfido2_cflags,
                         libgcrypt_cflags,
                         libgnutls_cflags,
+                        libidn2_cflags,
                         libkmod_cflags,
                         libmicrohttpd_cflags,
                         libmount_cflags,
+                        libopenssl_cflags,
                         libp11kit_cflags,
+                        libpam_cflags,
+                        libpcre2_cflags,
                         libseccomp_cflags,
+                        libselinux_cflags,
+                        tpm2_cflags,
                 ],
         },
         test_template + {
@@ -373,6 +397,7 @@ executables += [
         test_template + {
                 'sources' : files('test-curl-util.c'),
                 'conditions' : ['HAVE_LIBCURL'],
+                'dependencies' : libcurl_cflags,
         },
         test_template + {
                 'sources' : files('test-libcrypt-util.c'),
@@ -423,6 +448,10 @@ executables += [
                 'objects' : ['test-nss-hosts'],
                 'conditions' : ['ENABLE_NSS'],
         },
+        test_template + {
+                'sources' : files('test-pe-binary.c'),
+                'dependencies' : libopenssl_cflags,
+        },
         test_template + {
                 'sources' : files('test-pkcs7-util.c'),
                 'dependencies' : libopenssl_cflags,
@@ -476,7 +505,10 @@ executables += [
         },
         test_template + {
                 'sources' : files('test-tpm2.c'),
-                'dependencies' : libopenssl_cflags,
+                'dependencies' : [
+                        libopenssl_cflags,
+                        tpm2_cflags,
+                ],
                 'timeout' : 120,
         },
         test_template + {
@@ -528,11 +560,17 @@ executables += [
         },
         core_test_template + {
                 'sources' : files('test-bpf-restrict-fs.c'),
-                'dependencies' : common_test_dependencies,
+                'dependencies' : [
+                        common_test_dependencies,
+                        libbpf_cflags,
+                ],
         },
         core_test_template + {
                 'sources' : files('test-bpf-restrict-fsaccess.c'),
-                'dependencies' : common_test_dependencies,
+                'dependencies' : [
+                        common_test_dependencies,
+                        libbpf_cflags,
+                ],
                 'bpf_programs' : ['restrict-fsaccess'],
                 'type' : 'manual',
         },
@@ -584,7 +622,10 @@ executables += [
         },
         core_test_template + {
                 'sources' : files('test-load-fragment.c'),
-                'dependencies' : common_test_dependencies,
+                'dependencies' : [
+                        common_test_dependencies,
+                        libpcre2_cflags,
+                ],
         },
         core_test_template + {
                 'sources' : files('test-loop-util.c'),
diff --git a/src/tmpfiles/meson.build b/src/tmpfiles/meson.build
index 2a7728c295..fcf2749e4b 100644
--- a/src/tmpfiles/meson.build
+++ b/src/tmpfiles/meson.build
@@ -12,7 +12,10 @@ executables += [
                 'public' : true,
                 'extract' : files('tmpfiles.c') +
                             offline_passwd_c,
-                'dependencies' : libacl_cflags,
+                'dependencies' : [
+                        libacl_cflags,
+                        libselinux_cflags,
+                ],
         },
         executable_template + {
                 'name' : 'systemd-tmpfiles.standalone',
@@ -24,7 +27,10 @@ executables += [
                         libshared_static,
                         libsystemd_static,
                 ],
-                'dependencies' : libacl_cflags,
+                'dependencies' : [
+                        libacl_cflags,
+                        libselinux_cflags,
+                ],
         },
         test_template + {
                 'sources' : files('test-offline-passwd.c') +
diff --git a/src/tpm2-setup/meson.build b/src/tpm2-setup/meson.build
index 55f0ce26d3..bb3c3338ba 100644
--- a/src/tpm2-setup/meson.build
+++ b/src/tpm2-setup/meson.build
@@ -11,6 +11,7 @@ executables += [
                 ],
                 'dependencies' : [
                         libopenssl_cflags,
+                        tpm2_cflags,
                 ],
         },
         libexec_template + {
@@ -21,6 +22,9 @@ executables += [
                         'HAVE_OPENSSL',
                         'HAVE_TPM2',
                 ],
+                'dependencies' : [
+                        tpm2_cflags,
+                ],
         },
         libexec_template + {
                 'name' : 'systemd-tpm2-swtpm',
@@ -39,6 +43,9 @@ executables += [
                         'HAVE_OPENSSL',
                         'HAVE_TPM2',
                 ],
+                'dependencies' : [
+                        tpm2_cflags,
+                ],
         },
 ]
 
diff --git a/src/udev/meson.build b/src/udev/meson.build
index 375645e759..6c2232c74c 100644
--- a/src/udev/meson.build
+++ b/src/udev/meson.build
@@ -122,6 +122,8 @@ udev_dependencies = [
         libblkid_cflags,
         libkmod_cflags,
         libmount_cflags,
+        libselinux_cflags,
+        tpm2_cflags,
 ]
 
 udev_plugin_template = executable_template + {
diff --git a/src/veritysetup/meson.build b/src/veritysetup/meson.build
index 21432d41f1..437e58ecd8 100644
--- a/src/veritysetup/meson.build
+++ b/src/veritysetup/meson.build
@@ -8,7 +8,10 @@ executables += [
         libexec_template + {
                 'name' : 'systemd-veritysetup',
                 'sources' : files('veritysetup.c'),
-                'dependencies' : libcryptsetup_cflags,
+                'dependencies' : [
+                        libcryptsetup_cflags,
+                        tpm2_cflags,
+                ],
         },
         generator_template + {
                 'name' : 'systemd-veritysetup-generator',