diff --git a/src/fuzz/fuzz.h b/src/fuzz/fuzz.h
index a7d3a89fe2c..77e0ad98dc3 100644
--- a/src/fuzz/fuzz.h
+++ b/src/fuzz/fuzz.h
@@ -14,7 +14,7 @@ static inline FILE* data_to_file(const uint8_t *data, size_t size) {
         if (size == 0)
                 return fopen("/dev/null", "re");
         else
-                return fmemopen_unlocked((char*) data, size, "re");
+                return fmemopen_unlocked((char*) data, size, "r");
 }
 
 /* Check if we are within the specified size range.
diff --git a/src/portable/portablectl.c b/src/portable/portablectl.c
index 341e70621fd..dbae8a4d476 100644
--- a/src/portable/portablectl.c
+++ b/src/portable/portablectl.c
@@ -344,7 +344,7 @@ static int inspect_image(int argc, char *argv[], void *userdata) {
                 _cleanup_free_ char *pretty_portable = NULL, *pretty_os = NULL;
                 _cleanup_fclose_ FILE *f = NULL;
 
-                f = fmemopen_unlocked((void*) data, sz, "re");
+                f = fmemopen_unlocked((void*) data, sz, "r");
                 if (!f)
                         return log_error_errno(errno, "Failed to open /etc/os-release buffer: %m");
 
@@ -400,7 +400,7 @@ static int inspect_image(int argc, char *argv[], void *userdata) {
                                         *id = NULL, *version_id = NULL, *sysext_scope = NULL, *portable_prefixes = NULL;
                                 _cleanup_fclose_ FILE *f = NULL;
 
-                                f = fmemopen_unlocked((void*) data, sz, "re");
+                                f = fmemopen_unlocked((void*) data, sz, "r");
                                 if (!f)
                                         return log_error_errno(errno, "Failed to open extension-release buffer: %m");
 
diff --git a/src/resolve/resolved-dns-trust-anchor.c b/src/resolve/resolved-dns-trust-anchor.c
index 9dbe8610705..69a484dc129 100644
--- a/src/resolve/resolved-dns-trust-anchor.c
+++ b/src/resolve/resolved-dns-trust-anchor.c
@@ -423,7 +423,7 @@ static int dns_trust_anchor_load_files(
                 _cleanup_fclose_ FILE *g = NULL;
                 unsigned n = 0;
 
-                g = fopen(*f, "r");
+                g = fopen(*f, "re");
                 if (!g) {
                         if (errno == ENOENT)
                                 continue;
diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c
index 16c907587c0..13e92c41445 100644
--- a/src/shared/tpm2-util.c
+++ b/src/shared/tpm2-util.c
@@ -1049,7 +1049,8 @@ static int tpm2_make_policy_session(
 #if HAVE_OPENSSL
         _cleanup_(EVP_PKEY_freep) EVP_PKEY *pk = NULL;
         if (pubkey_size > 0) {
-                /* If a pubkey is specified, load it to validate it, even if the PCR mask for this is actually zero, and we are thus not going to use it. */
+                /* If a pubkey is specified, load it to validate it, even if the PCR mask for this is
+                 * actually zero, and we are thus not going to use it. */
                 _cleanup_fclose_ FILE *f = fmemopen((void*) pubkey, pubkey_size, "r");
                 if (!f)
                         return log_oom();
@@ -1579,11 +1580,11 @@ int tpm2_unseal(const char *device,
                 return log_error_errno(r, "TPM2 support is not installed.");
 
         /* So here's what we do here: We connect to the TPM2 chip. As we do when sealing we generate a
-         * "primary" key on the TPM2 chip, with the same parameters as well as a PCR-bound policy
-         * session. Given we pass the same parameters, this will result in the same "primary" key, and same
-         * policy hash (the latter of course, only if the PCR values didn't change in between). We unmarshal
-         * the encrypted key we stored in the LUKS2 JSON token header and upload it into the TPM2, where it
-         * is decrypted if the seed and the PCR policy were right ("unsealing"). We then download the result,
+         * "primary" key on the TPM2 chip, with the same parameters as well as a PCR-bound policy session.
+         * Given we pass the same parameters, this will result in the same "primary" key, and same policy
+         * hash (the latter of course, only if the PCR values didn't change in between). We unmarshal the
+         * encrypted key we stored in the LUKS2 JSON token header and upload it into the TPM2, where it is
+         * decrypted if the seed and the PCR policy were right ("unsealing"). We then download the result,
          * and use it to unlock the LUKS2 volume. */
 
         start = now(CLOCK_MONOTONIC);
diff --git a/src/test/test-fileio.c b/src/test/test-fileio.c
index 2cc71078032..ba6dd9ace9d 100644
--- a/src/test/test-fileio.c
+++ b/src/test/test-fileio.c
@@ -554,15 +554,15 @@ TEST(search_and_fopen) {
         f = safe_fclose(f);
         p = mfree(p);
 
-        r = search_and_fopen("/a/file/which/does/not/exist/i/guess", "r", NULL, (const char**) dirs, &f, &p);
+        r = search_and_fopen("/a/file/which/does/not/exist/i/guess", "re", NULL, (const char**) dirs, &f, &p);
         assert_se(r == -ENOENT);
-        r = search_and_fopen("afilewhichdoesnotexistiguess", "r", NULL, (const char**) dirs, &f, &p);
+        r = search_and_fopen("afilewhichdoesnotexistiguess", "re", NULL, (const char**) dirs, &f, &p);
         assert_se(r == -ENOENT);
 
         r = unlink(name);
         assert_se(r == 0);
 
-        r = search_and_fopen(basename(name), "r", NULL, (const char**) dirs, &f, &p);
+        r = search_and_fopen(basename(name), "re", NULL, (const char**) dirs, &f, &p);
         assert_se(r == -ENOENT);
 }
 
@@ -595,15 +595,15 @@ TEST(search_and_fopen_nulstr) {
         f = safe_fclose(f);
         p = mfree(p);
 
-        r = search_and_fopen_nulstr("/a/file/which/does/not/exist/i/guess", "r", NULL, dirs, &f, &p);
+        r = search_and_fopen_nulstr("/a/file/which/does/not/exist/i/guess", "re", NULL, dirs, &f, &p);
         assert_se(r == -ENOENT);
-        r = search_and_fopen_nulstr("afilewhichdoesnotexistiguess", "r", NULL, dirs, &f, &p);
+        r = search_and_fopen_nulstr("afilewhichdoesnotexistiguess", "re", NULL, dirs, &f, &p);
         assert_se(r == -ENOENT);
 
         r = unlink(name);
         assert_se(r == 0);
 
-        r = search_and_fopen_nulstr(basename(name), "r", NULL, dirs, &f, &p);
+        r = search_and_fopen_nulstr(basename(name), "re", NULL, dirs, &f, &p);
         assert_se(r == -ENOENT);
 }
 
@@ -677,7 +677,7 @@ TEST(fgetc) {
         _cleanup_fclose_ FILE *f = NULL;
         char c;
 
-        assert_se(f = fmemopen_unlocked((void*) chars, sizeof(chars), "re"));
+        assert_se(f = fmemopen_unlocked((void*) chars, sizeof(chars), "r"));
 
         for (size_t i = 0; i < sizeof(chars); i++) {
                 assert_se(safe_fgetc(f, &c) == 1);
@@ -770,7 +770,7 @@ static void test_read_line_one_file(FILE *f) {
 TEST(read_line1) {
         _cleanup_fclose_ FILE *f = NULL;
 
-        assert_se(f = fmemopen_unlocked((void*) buffer, sizeof(buffer), "re"));
+        assert_se(f = fmemopen_unlocked((void*) buffer, sizeof(buffer), "r"));
         test_read_line_one_file(f);
 }
 
diff --git a/src/test/test-libmount.c b/src/test/test-libmount.c
index b3e1a327ab4..9ba428e5bef 100644
--- a/src/test/test-libmount.c
+++ b/src/test/test-libmount.c
@@ -21,7 +21,7 @@ static void test_libmount_unescaping_one(
         _cleanup_(mnt_free_iterp) struct libmnt_iter *iter = NULL;
         _cleanup_fclose_ FILE *f = NULL;
 
-        f = fmemopen((char*) string, strlen(string), "re");
+        f = fmemopen((char*) string, strlen(string), "r");
         assert_se(f);
 
         assert_se(libmount_parse(title, f, &table, &iter) >= 0);