diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index 38196ef3d6..8ac86eeb55 100644
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -1569,19 +1569,16 @@ static int parse_argv(int argc, char *argv[]) {
 
                 case ARG_SET_CREDENTIAL:
                         r = machine_credential_set(&arg_credentials, &arg_n_credentials, optarg);
-                        if (r == -ENOMEM)
-                                return log_oom();
                         if (r < 0)
-                                return log_error_errno(r, "Failed to set credential from %s: %m", optarg);
+                                return r;
+
                         arg_settings_mask |= SETTING_CREDENTIALS;
                         break;
 
                 case ARG_LOAD_CREDENTIAL:
                         r = machine_credential_load(&arg_credentials, &arg_n_credentials, optarg);
-                        if (r == -ENOMEM)
-                                return log_oom();
                         if (r < 0)
-                                return log_error_errno(r, "Failed to load credential from %s: %m", optarg);
+                                return r;
 
                         arg_settings_mask |= SETTING_CREDENTIALS;
                         break;
diff --git a/src/shared/machine-credential.c b/src/shared/machine-credential.c
index 752bf0da9c..17f7afc4a0 100644
--- a/src/shared/machine-credential.c
+++ b/src/shared/machine-credential.c
@@ -30,26 +30,23 @@ void machine_credential_free_all(MachineCredential *creds, size_t n) {
 
 int machine_credential_set(MachineCredential **credentials, size_t *n_credentials, const char *cred_string) {
         _cleanup_free_ char *word = NULL, *data = NULL;
-        MachineCredential *creds = *ASSERT_PTR(credentials);
         ssize_t l;
-        size_t n_creds = *ASSERT_PTR(n_credentials);
         int r;
         const char *p = ASSERT_PTR(cred_string);
 
-        assert(creds || n_creds == 0);
+        assert(credentials && n_credentials);
+        assert(*credentials || *n_credentials == 0);
 
         r = extract_first_word(&p, &word, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
-        if (r == -ENOMEM)
-                return r;
         if (r < 0)
                 return log_error_errno(r, "Failed to parse --set-credential= parameter: %m");
         if (r == 0 || !p)
                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Missing value for --set-credential=: %s", cred_string);
 
         if (!credential_name_valid(word))
-                return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "MachineCredential name is not valid: %s", word);
+                return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Credential name is not valid: %s", word);
 
-        FOREACH_ARRAY(cred, creds, n_creds)
+        FOREACH_ARRAY(cred, *credentials, *n_credentials)
                 if (streq(cred->id, word))
                         return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Duplicate credential '%s', refusing.", word);
 
@@ -57,19 +54,15 @@ int machine_credential_set(MachineCredential **credentials, size_t *n_credential
         if (l < 0)
                 return log_error_errno(l, "Failed to unescape credential data: %s", p);
 
-        GREEDY_REALLOC(creds, n_creds + 1);
-        if (!creds)
-                return -ENOMEM;
+        if (!GREEDY_REALLOC(*credentials, *n_credentials + 1))
+                return log_oom();
 
-        creds[n_creds++] = (MachineCredential) {
+        (*credentials)[(*n_credentials)++] = (MachineCredential) {
                 .id = TAKE_PTR(word),
                 .data = TAKE_PTR(data),
                 .size = l,
         };
 
-        *credentials = creds;
-        *n_credentials = n_creds;
-
         return 0;
 }
 
@@ -77,61 +70,58 @@ int machine_credential_load(MachineCredential **credentials, size_t *n_credentia
         ReadFullFileFlags flags = READ_FULL_FILE_SECURE;
         _cleanup_(erase_and_freep) char *data = NULL;
         _cleanup_free_ char *word = NULL, *j = NULL;
-        MachineCredential *creds = *ASSERT_PTR(credentials);
-        size_t size, n_creds = *ASSERT_PTR(n_credentials);
-        int r;
         const char *p = ASSERT_PTR(cred_path);
+        size_t size;
+        int r;
 
-        assert(creds || n_creds == 0);
+        assert(credentials && n_credentials);
+        assert(*credentials || *n_credentials == 0);
 
         r = extract_first_word(&p, &word, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
-        if (r == -ENOMEM)
-                return -ENOMEM;
         if (r < 0)
                 return log_error_errno(r, "Failed to parse --load-credential= parameter: %m");
         if (r == 0 || !p)
                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Missing value for --load-credential=: %s", cred_path);
 
         if (!credential_name_valid(word))
-                return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "MachineCredential name is not valid: %s", word);
+                return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Credential name is not valid: %s", word);
 
-        FOREACH_ARRAY(cred, creds, n_creds)
+        FOREACH_ARRAY(cred, *credentials, *n_credentials)
                 if (streq(cred->id, word))
                         return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Duplicate credential '%s', refusing.", word);
 
-        if (path_is_absolute(p))
+        if (is_path(p) && path_is_valid(p))
                 flags |= READ_FULL_FILE_CONNECT_SOCKET;
-        else {
+        else if (credential_name_valid(p)) {
                 const char *e;
 
                 r = get_credentials_dir(&e);
                 if (r < 0)
-                        return log_error_errno(r, "MachineCredential not available (no credentials passed at all): %s", word);
+                        return log_error_errno(r, "Credential not available (no credentials passed at all): %s", word);
 
                 j = path_join(e, p);
                 if (!j)
-                        return -ENOMEM;
-        }
+                        return log_oom();
 
-        r = read_full_file_full(AT_FDCWD, j ?: p, UINT64_MAX, SIZE_MAX,
+                p = j;
+        } else
+                return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Credential source appears to be neither a valid path nor a credential name: %s", p);
+
+        r = read_full_file_full(AT_FDCWD, p, UINT64_MAX, SIZE_MAX,
                                 flags,
                                 NULL,
                                 &data, &size);
         if (r < 0)
-                return log_error_errno(r, "Failed to read credential '%s': %m", j ?: p);
+                return log_error_errno(r, "Failed to read credential '%s': %m", p);
 
-        GREEDY_REALLOC(creds, n_creds + 1);
-        if (!creds)
-                return -ENOMEM;
+        if (!GREEDY_REALLOC(*credentials, *n_credentials + 1))
+                return log_oom();
 
-        creds[n_creds++] = (MachineCredential) {
+        (*credentials)[(*n_credentials)++] = (MachineCredential) {
                 .id = TAKE_PTR(word),
                 .data = TAKE_PTR(data),
                 .size = size,
         };
 
-        *credentials = creds;
-        *n_credentials = n_creds;
-
         return 0;
 }
diff --git a/src/vmspawn/vmspawn.c b/src/vmspawn/vmspawn.c
index 6cfaed97f0..ebae681893 100644
--- a/src/vmspawn/vmspawn.c
+++ b/src/vmspawn/vmspawn.c
@@ -225,20 +225,16 @@ static int parse_argv(int argc, char *argv[]) {
 
                 case ARG_SET_CREDENTIAL: {
                         r = machine_credential_set(&arg_credentials, &arg_n_credentials, optarg);
-                        if (r == -ENOMEM)
-                                return log_oom();
                         if (r < 0)
-                                return log_error_errno(r, "Failed to set credential from %s: %m", optarg);
+                                return r;
                         arg_settings_mask |= SETTING_CREDENTIALS;
                         break;
                 }
 
                 case ARG_LOAD_CREDENTIAL: {
                         r = machine_credential_load(&arg_credentials, &arg_n_credentials, optarg);
-                        if (r == -ENOMEM)
-                                return log_oom();
                         if (r < 0)
-                                return log_error_errno(r, "Failed to load credential from %s: %m", optarg);
+                                return r;
 
                         arg_settings_mask |= SETTING_CREDENTIALS;
                         break;