diff --git a/src/basic/compress.c b/src/basic/compress.c
index 5c9ca829df..d9759ad417 100644
--- a/src/basic/compress.c
+++ b/src/basic/compress.c
@@ -398,6 +398,8 @@ int decompress_blob_xz(
                         return -ENOBUFS;
 
                 used = space - s.avail_out;
+                /* Silence static analyzers, space is bounded by allocation size */
+                assert(space <= SIZE_MAX / 2);
                 space = MIN(2 * space, dst_max ?: SIZE_MAX);
                 if (!greedy_realloc(dst, space, 1))
                         return -ENOMEM;
diff --git a/src/basic/recurse-dir.c b/src/basic/recurse-dir.c
index 0efa731868..bc3c32afe6 100644
--- a/src/basic/recurse-dir.c
+++ b/src/basic/recurse-dir.c
@@ -41,6 +41,8 @@ int readdir_all(int dir_fd, RecurseDirFlags flags, DirectoryEntries **ret) {
          * Start with space for up to 8 directory entries. We expect at least 2 ("." + ".."), hence hopefully
          * 8 will cover most cases comprehensively. (Note that most likely a lot more entries will actually
          * fit in the buffer, given we calculate maximum file name length here.) */
+        /* Silence static analyzers */
+        assert_cc(offsetof(DirectoryEntries, buffer) <= SIZE_MAX - DIRENT_SIZE_MAX * 8);
         de = malloc(offsetof(DirectoryEntries, buffer) + DIRENT_SIZE_MAX * 8);
         if (!de)
                 return -ENOMEM;
diff --git a/src/basic/stat-util.c b/src/basic/stat-util.c
index ac218d1552..d04da52a78 100644
--- a/src/basic/stat-util.c
+++ b/src/basic/stat-util.c
@@ -153,7 +153,7 @@ int is_symlink(const char *path) {
         return verify_stat_at(AT_FDCWD, path, false, stat_verify_symlink, false);
 }
 
-static mode_t mode_verify_socket(mode_t mode) {
+static int mode_verify_socket(mode_t mode) {
         if (S_ISLNK(mode))
                 return -ELOOP;
 
@@ -516,15 +516,17 @@ int inode_same_at(int fda, const char *filea, int fdb, const char *fileb, int fl
 
                         goto fallback;
                 }
-                if (r == 0)
+                bool have_unique_mntid = r > 0;
+
+                if (!have_unique_mntid)
                         mntida = _mntida;
 
                 r = name_to_handle_at_try_fid(
                                 fdb,
                                 fileb,
                                 &hb,
-                                r > 0 ? NULL : &_mntidb, /* if we managed to get unique mnt id for a, insist on that for b */
-                                r > 0 ? &mntidb : NULL,
+                                have_unique_mntid ? NULL : &_mntidb, /* if we managed to get unique mnt id for a, insist on that for b */
+                                have_unique_mntid ? &mntidb : NULL,
                                 ntha_flags);
                 if (r < 0) {
                         if (is_name_to_handle_at_fatal_error(r))
@@ -532,8 +534,10 @@ int inode_same_at(int fda, const char *filea, int fdb, const char *fileb, int fl
 
                         goto fallback;
                 }
-                if (r == 0)
+                if (r == 0) {
+                        assert(!have_unique_mntid); /* _mntidb was initialized by name_to_handle_at_try_fid() */
                         mntidb = _mntidb;
+                }
 
                 /* Now compare the two file handles */
                 if (!file_handle_equal(ha, hb))
diff --git a/src/basic/uid-range.c b/src/basic/uid-range.c
index 31305952ba..628710a870 100644
--- a/src/basic/uid-range.c
+++ b/src/basic/uid-range.c
@@ -63,6 +63,10 @@ static void uid_range_coalesce(UIDRange *range) {
                                 break;
 
                         begin = MIN(x->start, y->start);
+
+                        /* Silence static analyzers, overflow is prevented by uid_range_add_internal() */
+                        assert(x->start <= UINT32_MAX - x->nr);
+                        assert(y->start <= UINT32_MAX - y->nr);
                         end = MAX(x->start + x->nr, y->start + y->nr);
 
                         x->start = begin;
diff --git a/src/boot/part-discovery.c b/src/boot/part-discovery.c
index dc1aed0514..25f60521ac 100644
--- a/src/boot/part-discovery.c
+++ b/src/boot/part-discovery.c
@@ -117,6 +117,8 @@ static EFI_STATUS try_gpt(
 
         /* Now load the GPT entry table */
         size = ALIGN_TO((size_t) gpt->SizeOfPartitionEntry * (size_t) gpt->NumberOfPartitionEntries, 512);
+        if (size == SIZE_MAX) /* overflow check */
+                return EFI_OUT_OF_RESOURCES;
         entries_pages = xmalloc_aligned_pages(
                 AllocateMaxAddress,
                 EfiLoaderData,
diff --git a/src/debug-generator/debug-generator.c b/src/debug-generator/debug-generator.c
index 878e115232..e3b7768fbc 100644
--- a/src/debug-generator/debug-generator.c
+++ b/src/debug-generator/debug-generator.c
@@ -101,7 +101,7 @@ static int parse_breakpoint_from_string(const char *s, uint32_t *ret_breakpoints
 
                 FOREACH_ELEMENT(i, breakpoint_info_table)
                         if (FLAGS_SET(i->validity, BREAKPOINT_DEFAULT) && breakpoint_applies(i, INT_MAX)) {
-                                breakpoints |= 1 << i->type;
+                                breakpoints |= UINT32_C(1) << i->type;
                                 found_default = true;
                                 break;
                         }
@@ -127,7 +127,7 @@ static int parse_breakpoint_from_string(const char *s, uint32_t *ret_breakpoints
                         }
 
                         if (breakpoint_applies(&breakpoint_info_table[tt], LOG_WARNING))
-                                breakpoints |= 1 << tt;
+                                breakpoints |= UINT32_C(1) << tt;
                 }
 
         *ret_breakpoints = breakpoints;
diff --git a/src/imds/imdsd.c b/src/imds/imdsd.c
index 565f21cfaa..68a03b7232 100644
--- a/src/imds/imdsd.c
+++ b/src/imds/imdsd.c
@@ -275,7 +275,7 @@ static void context_reset_for_refresh(Context *c) {
         c->child_data = hashmap_free(c->child_data);
         c->data_size = 0;
 
-        sd_event_source_set_enabled(c->retry_source, SD_EVENT_OFF);
+        (void) sd_event_source_set_enabled(c->retry_source, SD_EVENT_OFF);
 }
 
 static void context_reset_full(Context *c) {
diff --git a/src/import/importd.c b/src/import/importd.c
index 0de1b21fa5..5e733f757a 100644
--- a/src/import/importd.c
+++ b/src/import/importd.c
@@ -418,6 +418,8 @@ static int transfer_on_log(sd_event_source *s, int fd, uint32_t revents, void *u
                 return 0;
         }
 
+        /* Silence static analyzers, l is bounded by read() count: sizeof - log_message_size */
+        assert((size_t) l <= sizeof(t->log_message) - t->log_message_size);
         t->log_message_size += l;
 
         transfer_send_logs(t, false);
diff --git a/src/libsystemd/sd-bus/bus-socket.c b/src/libsystemd/sd-bus/bus-socket.c
index 4cac317dff..3c6a2b2747 100644
--- a/src/libsystemd/sd-bus/bus-socket.c
+++ b/src/libsystemd/sd-bus/bus-socket.c
@@ -676,6 +676,8 @@ static int bus_socket_read_auth(sd_bus *b) {
                 return -ECONNRESET;
         }
 
+        /* Silence static analyzers, k is bounded by iov size: n - rbuffer_size */
+        assert((size_t) k <= n - b->rbuffer_size);
         b->rbuffer_size += k;
 
         if (handle_cmsg) {
@@ -1453,6 +1455,8 @@ int bus_socket_read_message(sd_bus *bus) {
                 return -EXFULL;
         }
 
+        /* Silence static analyzers, k is bounded by iov size: need - rbuffer_size */
+        assert((size_t) k <= need - bus->rbuffer_size);
         bus->rbuffer_size += k;
 
         if (handle_cmsg) {
diff --git a/src/libsystemd/sd-event/sd-event.c b/src/libsystemd/sd-event/sd-event.c
index b78cfe86fa..6867385e92 100644
--- a/src/libsystemd/sd-event/sd-event.c
+++ b/src/libsystemd/sd-event/sd-event.c
@@ -3807,6 +3807,9 @@ static int process_signal(sd_event *e, struct signal_data *d, uint32_t events, i
                 if (_unlikely_(!SIGNAL_VALID(si.ssi_signo)))
                         return -EIO;
 
+                /* Silence static analyzers */
+                assert(si.ssi_signo < _NSIG);
+
                 if (e->signal_sources)
                         s = e->signal_sources[si.ssi_signo];
                 if (!s)
diff --git a/src/resolve/resolved-hook.c b/src/resolve/resolved-hook.c
index 4938e2d2a1..9625e64fe2 100644
--- a/src/resolve/resolved-hook.c
+++ b/src/resolve/resolved-hook.c
@@ -391,19 +391,6 @@ static int manager_hook_discover(Manager *m) {
 
         usec_t seen_usec = now(CLOCK_MONOTONIC);
 
-        struct stat st;
-        if (stat(dp, &st) < 0) {
-                if (errno == ENOENT)
-                        r = 0;
-                else
-                        r = log_warning_errno(errno, "Failed to stat %s/: %m", dp);
-
-                goto finish;
-        }
-
-        if (stat_inode_unmodified(&st, &m->hook_stat))
-                return 0;
-
         d = opendir(dp);
         if (!d) {
                 if (errno == ENOENT)
@@ -414,6 +401,15 @@ static int manager_hook_discover(Manager *m) {
                 goto finish;
         }
 
+        struct stat st;
+        if (fstat(dirfd(d), &st) < 0) {
+                r = log_warning_errno(errno, "Failed to fstat %s/: %m", dp);
+                goto finish;
+        }
+
+        if (stat_inode_unmodified(&st, &m->hook_stat))
+                return 0;
+
         for (;;) {
                 errno = 0;
                 struct dirent *de = readdir_no_dot(d);
diff --git a/src/shared/cpu-set-util.c b/src/shared/cpu-set-util.c
index e4ef36da9a..9211dbe47e 100644
--- a/src/shared/cpu-set-util.c
+++ b/src/shared/cpu-set-util.c
@@ -159,6 +159,8 @@ int cpu_set_add(CPUSet *c, size_t i) {
         if (r < 0)
                 return r;
 
+        /* Silence static analyzers */
+        assert(i / CHAR_BIT < c->allocated);
         CPU_SET_S(i, c->allocated, c->set);
         return 0;
 }
@@ -194,6 +196,8 @@ int cpu_set_add_range(CPUSet *c, size_t start, size_t end) {
         if (r < 0)
                 return r;
 
+        /* Silence static analyzers */
+        assert(end / CHAR_BIT < c->allocated);
         for (size_t i = start; i <= end; i++)
                 CPU_SET_S(i, c->allocated, c->set);
 
diff --git a/src/shared/dissect-image.c b/src/shared/dissect-image.c
index d68ea0bc97..4a8d4a5c0e 100644
--- a/src/shared/dissect-image.c
+++ b/src/shared/dissect-image.c
@@ -1703,6 +1703,10 @@ static int dissect_image(
                 PartitionDesignator dv = partition_verity_hash_of(*dd);
                 PartitionDesignator ds = partition_verity_sig_of(*dd);
 
+                /* Hint to help static analyzers */
+                assert(dv >= 0);
+                assert(ds >= 0);
+
                 if (!m->partitions[*dd].found && (m->partitions[dv].found || m->partitions[ds].found))
                         return log_debug_errno(
                                         SYNTHETIC_ERRNO(EADDRNOTAVAIL),
diff --git a/src/shared/exec-util.c b/src/shared/exec-util.c
index 2e15f311b8..420803c77d 100644
--- a/src/shared/exec-util.c
+++ b/src/shared/exec-util.c
@@ -500,7 +500,7 @@ assert_cc((1 << ELEMENTSOF(exec_command_strings)) - 1 == _EXEC_COMMAND_FLAGS_ALL
 
 const char* exec_command_flags_to_string(ExecCommandFlags i) {
         for (size_t idx = 0; idx < ELEMENTSOF(exec_command_strings); idx++)
-                if (i == (1 << idx))
+                if (i == (ExecCommandFlags) (1U << idx))
                         return exec_command_strings[idx];
 
         return NULL;
@@ -516,7 +516,7 @@ ExecCommandFlags exec_command_flags_from_string(const char *s) {
         if (idx < 0)
                 return _EXEC_COMMAND_FLAGS_INVALID;
 
-        return 1 << idx;
+        return 1U << idx;
 }
 
 int fexecve_or_execve(int executable_fd, const char *executable, char *const argv[], char *const envp[]) {
diff --git a/src/shared/pe-binary.c b/src/shared/pe-binary.c
index f342801bea..da54428306 100644
--- a/src/shared/pe-binary.c
+++ b/src/shared/pe-binary.c
@@ -421,9 +421,9 @@ int pe_hash(int fd,
         if ((uint64_t) st.st_size > p) {
 
                 if ((uint64_t) st.st_size - p < le32toh(certificate_table->Size))
-                        return log_debug_errno(errno, "No space for certificate table, refusing.");
+                        return log_debug_errno(SYNTHETIC_ERRNO(EBADMSG), "No space for certificate table, refusing.");
 
-                r = hash_file(fd, mdctx, p, st.st_size - p - le32toh(certificate_table->Size));
+                r = hash_file(fd, mdctx, p, (uint64_t) st.st_size - p - le32toh(certificate_table->Size));
                 if (r < 0)
                         return r;
 
diff --git a/src/udev/scsi_id/scsi_serial.c b/src/udev/scsi_id/scsi_serial.c
index 20caf695bf..82557e3b05 100644
--- a/src/udev/scsi_id/scsi_serial.c
+++ b/src/udev/scsi_id/scsi_serial.c
@@ -21,6 +21,7 @@
 #include "scsi.h"
 #include "scsi_id.h"
 #include "string-util.h"
+#include "strxcpyx.h"
 #include "time-util.h"
 
 /*
@@ -517,9 +518,9 @@ static int check_fill_0x83_id(struct scsi_id_device *dev_scsi,
         strcpy(serial_short, serial + s);
 
         if (id_search->id_type == SCSI_ID_NAA && wwn != NULL) {
-                strncpy(wwn, serial + s, 16);
+                strscpy(wwn, 17, serial + s);
                 if (wwn_vendor_extension)
-                        strncpy(wwn_vendor_extension, serial + s + 16, 16);
+                        strscpy(wwn_vendor_extension, 17, serial + s + 16);
         }
 
         return 0;