diff --git a/src/shared/cryptsetup-util.h b/src/shared/cryptsetup-util.h
index fc80edb411..b1ce07ec8a 100644
--- a/src/shared/cryptsetup-util.h
+++ b/src/shared/cryptsetup-util.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include "alloc-util.h"
 #include "json.h"
 #include "macro.h"
 
@@ -69,6 +70,10 @@ int dlopen_cryptsetup(void);
 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(struct crypt_device *, crypt_free, NULL);
 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(struct crypt_device *, sym_crypt_free, NULL);
 
+/* Be careful, this works with dlopen_cryptsetup(), that is, it calls sym_crypt_free() instead of crypt_free(). */
+#define crypt_free_and_replace(a, b)                    \
+        free_and_replace_full(a, b, sym_crypt_free)
+
 void cryptsetup_enable_logging(struct crypt_device *cd);
 
 int cryptsetup_set_minimal_pbkdf(struct crypt_device *cd);
diff --git a/src/shared/dissect-image.c b/src/shared/dissect-image.c
index 274c33c35e..5eaff64f87 100644
--- a/src/shared/dissect-image.c
+++ b/src/shared/dissect-image.c
@@ -2016,8 +2016,7 @@ static int verity_partition(
                                 if (r < 0)
                                         return r;
 
-                                sym_crypt_free(cd);
-                                cd = TAKE_PTR(existing_cd);
+                                crypt_free_and_replace(cd, existing_cd);
                         }
                 }
                 if (r >= 0)