diff --git a/0001-meson-build-kernel-install-man-page-when-necessary.patch b/0001-meson-build-kernel-install-man-page-when-necessary.patch
new file mode 100644
index 00000000..8e601854
--- /dev/null
+++ b/0001-meson-build-kernel-install-man-page-when-necessary.patch
@@ -0,0 +1,90 @@
+From fecffebc9a0f4e2309e9d8d561c0b0c4b6678b0b Mon Sep 17 00:00:00 2001
+From: Franck Bui <fbui@suse.com>
+Date: Thu, 31 Mar 2022 11:17:10 +0200
+Subject: [PATCH 1/1] meson: build kernel-install man page when necessary
+
+---
+ man/rules/meson.build             | 2 +-
+ meson.build                       | 5 ++++-
+ shell-completion/bash/meson.build | 2 +-
+ shell-completion/zsh/meson.build  | 2 +-
+ src/kernel-install/meson.build    | 2 --
+ 5 files changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/man/rules/meson.build b/man/rules/meson.build
+index aaa69d3038..f10abdaf0d 100644
+--- a/man/rules/meson.build
++++ b/man/rules/meson.build
+@@ -30,7 +30,7 @@ manpages = [
+  ['journalctl', '1', [], ''],
+  ['journald.conf', '5', ['journald.conf.d', 'journald@.conf'], ''],
+  ['kernel-command-line', '7', [], ''],
+- ['kernel-install', '8', [], ''],
++ ['kernel-install', '8', [], 'ENABLE_KERNEL_INSTALL'],
+  ['libudev', '3', [], ''],
+  ['loader.conf', '5', [], 'HAVE_GNU_EFI'],
+  ['locale.conf', '5', [], ''],
+diff --git a/meson.build b/meson.build
+index e68791b8b4..311895db5e 100644
+--- a/meson.build
++++ b/meson.build
+@@ -1675,6 +1675,9 @@ else
+ endif
+ conf.set10('ENABLE_IMPORTD', have)
+ 
++want_kernel_install = get_option('kernel-install')
++conf.set10('ENABLE_KERNEL_INSTALL', want_kernel_install)
++
+ want_homed = get_option('homed')
+ if want_homed != 'false'
+         have = (conf.get('HAVE_OPENSSL') == 1 and
+@@ -4143,7 +4146,7 @@ foreach tuple : [
+         ['hwdb'],
+         ['importd'],
+         ['initrd'],
+-        ['kernel-install',        get_option('kernel-install')],
++        ['kernel-install'],
+         ['localed'],
+         ['logind'],
+         ['machined'],
+diff --git a/shell-completion/bash/meson.build b/shell-completion/bash/meson.build
+index 963a11b6ce..ae6a61e555 100644
+--- a/shell-completion/bash/meson.build
++++ b/shell-completion/bash/meson.build
+@@ -31,7 +31,7 @@ items = [['busctl',              ''],
+          ['systemd-path',        ''],
+          ['systemd-run',         ''],
+          ['udevadm',             ''],
+-         ['kernel-install',      ''],
++         ['kernel-install',      'ENABLE_KERNEL_INSTALL'],
+          ['bootctl',             'HAVE_GNU_EFI'],
+          ['coredumpctl',         'ENABLE_COREDUMP'],
+          ['homectl',             'ENABLE_HOMED'],
+diff --git a/shell-completion/zsh/meson.build b/shell-completion/zsh/meson.build
+index 6dca9dd595..bac531798c 100644
+--- a/shell-completion/zsh/meson.build
++++ b/shell-completion/zsh/meson.build
+@@ -22,7 +22,7 @@ items = [['_busctl',                   ''],
+          ['_systemd-path',             ''],
+          ['_systemd-run',              ''],
+          ['_udevadm',                  ''],
+-         ['_kernel-install',           ''],
++         ['_kernel-install',           'ENABLE_KERNEL_INSTALL'],
+          ['_sd_hosts_or_user_at_host', ''],
+          ['_sd_outputmodes',           ''],
+          ['_sd_unit_files',            ''],
+diff --git a/src/kernel-install/meson.build b/src/kernel-install/meson.build
+index 508058f1cf..abc3520b62 100644
+--- a/src/kernel-install/meson.build
++++ b/src/kernel-install/meson.build
+@@ -1,7 +1,5 @@
+ # SPDX-License-Identifier: LGPL-2.1-or-later
+ 
+-want_kernel_install = get_option('kernel-install')
+-
+ if want_kernel_install
+         install_data('kernel-install',
+                      install_mode : 'rwxr-xr-x',
+-- 
+2.34.1
+
diff --git a/files.systemd b/files.systemd
index b919c2af..044ab793 100644
--- a/files.systemd
+++ b/files.systemd
@@ -27,18 +27,11 @@
 %endif
 %dir %{_environmentdir}
 %dir %{_journalcatalogdir}
-%if ! %{bootstrap}
-%dir %{_libdir}/cryptsetup
-%endif
 %dir %{_localstatedir}/lib/systemd
 %dir %{_localstatedir}/lib/systemd/catalog
 %dir %{_modprobedir}
-%dir %{_modulesloaddir}
-%dir %{_prefix}/lib/kernel
-%dir %{_prefix}/lib/kernel/install.d
 %dir %{_sysconfdir}/X11/xorg.conf.d
 %dir %{_sysconfdir}/binfmt.d
-%dir %{_sysconfdir}/modules-load.d
 %dir %{_sysconfdir}/sysctl.d
 %dir %{_sysconfdir}/systemd
 %dir %{_sysconfdir}/systemd/system
@@ -49,10 +42,6 @@
 %dir %{_systemd_system_env_generator_dir}
 %dir %{_systemd_user_env_generator_dir}
 %dir %{_systemd_util_dir}
-%if %{with sd_boot}
-%dir %{_systemd_util_dir}/boot
-%dir %{_systemd_util_dir}/boot/efi
-%endif
 %dir %{_systemd_util_dir}/ntp-units.d
 %dir %{_systemd_util_dir}/scripts
 %dir %{_systemd_util_dir}/system-preset
@@ -97,18 +86,13 @@
 %ghost %config(noreplace) %{_sysconfdir}/machine-info
 %ghost %config(noreplace) %{_sysconfdir}/vconsole.conf
 %ghost %dir %attr(2755, root, systemd-journal) %{_localstatedir}/log/journal
-%ghost %{_localstatedir}/lib/systemd/backlight
 %ghost %{_localstatedir}/lib/systemd/catalog/database
 %ghost %{_localstatedir}/lib/systemd/i18n-migrated
 %license LICENSE.GPL2
 %license LICENSE.LGPL2.1
-%if %{with sd_boot}
-%{_bindir}/bootctl
-%endif
 %{_bindir}/busctl
 %{_bindir}/hostnamectl
 %{_bindir}/journalctl
-%{_bindir}/kernel-install
 %{_bindir}/localectl
 %{_bindir}/loginctl
 %{_bindir}/systemctl
@@ -118,9 +102,6 @@
 %{_bindir}/systemd-cgls
 %{_bindir}/systemd-cgtop
 %{_bindir}/systemd-creds
-%if ! %{bootstrap}
-%{_bindir}/systemd-cryptenroll
-%endif
 %{_bindir}/systemd-delta
 %{_bindir}/systemd-detect-virt
 %{_bindir}/systemd-dissect
@@ -142,14 +123,10 @@
 %{_bindir}/systemd-umount
 %{_bindir}/timedatectl
 %if ! %{bootstrap}
-%if %{with sd_boot}
-%{_datadir}/bash-completion/completions/bootctl
-%endif
 %{_datadir}/bash-completion/completions/busctl
 %{_datadir}/bash-completion/completions/coredumpctl
 %{_datadir}/bash-completion/completions/hostnamectl
 %{_datadir}/bash-completion/completions/journalctl
-%{_datadir}/bash-completion/completions/kernel-install
 %{_datadir}/bash-completion/completions/localectl
 %{_datadir}/bash-completion/completions/loginctl
 %{_datadir}/bash-completion/completions/portablectl
@@ -210,14 +187,10 @@
 %{_datadir}/systemd/kbd-model-map
 %{_datadir}/systemd/language-fallback-map
 %if ! %{bootstrap}
-%if %{with sd_boot}
-%{_datadir}/zsh/site-functions/_bootctl
-%endif
 %{_datadir}/zsh/site-functions/_busctl
 %{_datadir}/zsh/site-functions/_coredumpctl
 %{_datadir}/zsh/site-functions/_hostnamectl
 %{_datadir}/zsh/site-functions/_journalctl
-%{_datadir}/zsh/site-functions/_kernel-install
 %{_datadir}/zsh/site-functions/_localectl
 %{_datadir}/zsh/site-functions/_loginctl
 %{_datadir}/zsh/site-functions/_sd_hosts_or_user_at_host
@@ -247,14 +220,6 @@
 %{_journalcatalogdir}/systemd.zh_CN.catalog
 %{_journalcatalogdir}/systemd.zh_TW.catalog
 %if ! 0%{bootstrap}
-%{_libdir}/cryptsetup/libcryptsetup-token-systemd-fido2.so
-%{_libdir}/cryptsetup/libcryptsetup-token-systemd-pkcs11.so
-%{_libdir}/cryptsetup/libcryptsetup-token-systemd-tpm2.so
-%endif
-%if ! 0%{bootstrap}
-%if %{with sd_boot}
-%{_mandir}/man1/bootctl.1.gz
-%endif
 %{_mandir}/man1/busctl.1.gz
 %{_mandir}/man1/hostnamectl.1.gz
 %{_mandir}/man1/init.1.gz
@@ -268,7 +233,6 @@
 %{_mandir}/man1/systemd-cgls.1.gz
 %{_mandir}/man1/systemd-cgtop.1.gz
 %{_mandir}/man1/systemd-creds.1.gz
-%{_mandir}/man1/systemd-cryptenroll.1.gz
 %{_mandir}/man1/systemd-delta.1.gz
 %{_mandir}/man1/systemd-detect-virt.1.gz
 %{_mandir}/man1/systemd-dissect.1.gz
@@ -289,26 +253,20 @@
 %{_mandir}/man1/systemd.1.gz
 %{_mandir}/man1/timedatectl.1.gz
 %{_mandir}/man5/binfmt.d.5.gz
-%{_mandir}/man5/crypttab.5.gz
 %{_mandir}/man5/dnssec-trust-anchors.d.5.gz
 %{_mandir}/man5/environment.d.5.gz
 %{_mandir}/man5/extension-release.5.gz
 %{_mandir}/man5/hostname.5.gz
 %{_mandir}/man5/initrd-release.5.gz
-%{_mandir}/man5/integritytab.5.gz
 %{_mandir}/man5/journald.conf.5.gz
 %{_mandir}/man5/journald.conf.d.5.gz
 %{_mandir}/man5/journald@.conf.5.gz
-%if %{with sd_boot}
-%{_mandir}/man5/loader.conf.5.gz
-%endif
 %{_mandir}/man5/locale.conf.5.gz
 %{_mandir}/man5/localtime.5.gz
 %{_mandir}/man5/logind.conf.5.gz
 %{_mandir}/man5/logind.conf.d.5.gz
 %{_mandir}/man5/machine-id.5.gz
 %{_mandir}/man5/machine-info.5.gz
-%{_mandir}/man5/modules-load.d.5.gz
 %{_mandir}/man5/org.freedesktop.LogControl1.5.gz
 %{_mandir}/man5/org.freedesktop.hostname1.5.gz
 %{_mandir}/man5/org.freedesktop.locale1.5.gz
@@ -353,19 +311,10 @@
 %{_mandir}/man5/user.conf.d.5.gz
 %{_mandir}/man5/user@.service.5.gz
 %{_mandir}/man5/vconsole.conf.5.gz
-%{_mandir}/man5/veritytab.5.gz
 %{_mandir}/man7/bootup.7.gz
 %{_mandir}/man7/daemon.7.gz
 %{_mandir}/man7/file-hierarchy.7.gz
 %{_mandir}/man7/kernel-command-line.7.gz
-%if %{with sd_boot}
-%{_mandir}/man7/linuxaa64.efi.stub.7.gz
-%{_mandir}/man7/linuxia32.efi.stub.7.gz
-%{_mandir}/man7/linuxx64.efi.stub.7.gz
-%{_mandir}/man7/sd-boot.7.gz
-%{_mandir}/man7/systemd-boot.7.gz
-%{_mandir}/man7/systemd-stub.7.gz
-%endif
 %{_mandir}/man7/systemd.directives.7.gz
 %{_mandir}/man7/systemd.environment-generator.7.gz
 %{_mandir}/man7/systemd.generator.7.gz
@@ -378,7 +327,6 @@
 %{_mandir}/man7/systemd.time.7.gz
 %{_mandir}/man8/30-systemd-environment-d-generator.8.gz
 %{_mandir}/man8/halt.8.gz
-%{_mandir}/man8/kernel-install.8.gz
 %{_mandir}/man8/pam_systemd.8.gz
 %{_mandir}/man8/poweroff.8.gz
 %{_mandir}/man8/rc-local.service.8.gz
@@ -388,33 +336,16 @@
 %{_mandir}/man8/systemd-ask-password-console.service.8.gz
 %{_mandir}/man8/systemd-ask-password-wall.path.8.gz
 %{_mandir}/man8/systemd-ask-password-wall.service.8.gz
-%{_mandir}/man8/systemd-backlight.8.gz
-%{_mandir}/man8/systemd-backlight@.service.8.gz
 %{_mandir}/man8/systemd-binfmt.8.gz
 %{_mandir}/man8/systemd-binfmt.service.8.gz
-%if %{with sd_boot}
-%{_mandir}/man8/systemd-bless-boot-generator.8.gz
-%{_mandir}/man8/systemd-bless-boot.8.gz
-%{_mandir}/man8/systemd-bless-boot.service.8.gz
-%endif
 %{_mandir}/man8/systemd-boot-check-no-failures.8.gz
 %{_mandir}/man8/systemd-boot-check-no-failures.service.8.gz
-%if %{with sd_boot}
-%{_mandir}/man8/systemd-boot-system-token.service.8.gz
-%endif
-%{_mandir}/man8/systemd-cryptsetup-generator.8.gz
-%{_mandir}/man8/systemd-cryptsetup.8.gz
-%{_mandir}/man8/systemd-cryptsetup@.service.8.gz
 %{_mandir}/man8/systemd-debug-generator.8.gz
 %{_mandir}/man8/systemd-environment-d-generator.8.gz
 %{_mandir}/man8/systemd-fsck-root.service.8.gz
 %{_mandir}/man8/systemd-fsck.8.gz
 %{_mandir}/man8/systemd-fsck@.service.8.gz
-%{_mandir}/man8/systemd-fstab-generator.8.gz
 %{_mandir}/man8/systemd-getty-generator.8.gz
-%{_mandir}/man8/systemd-gpt-auto-generator.8.gz
-%{_mandir}/man8/systemd-growfs.8.gz
-%{_mandir}/man8/systemd-growfs@.service.8.gz
 %{_mandir}/man8/systemd-halt.service.8.gz
 %{_mandir}/man8/systemd-hibernate-resume-generator.8.gz
 %{_mandir}/man8/systemd-hibernate-resume.8.gz
@@ -423,9 +354,6 @@
 %{_mandir}/man8/systemd-hostnamed.8.gz
 %{_mandir}/man8/systemd-hostnamed.service.8.gz
 %{_mandir}/man8/systemd-hybrid-sleep.service.8.gz
-%{_mandir}/man8/systemd-integritysetup-generator.8.gz
-%{_mandir}/man8/systemd-integritysetup.8.gz
-%{_mandir}/man8/systemd-integritysetup@.service.8.gz
 %{_mandir}/man8/systemd-journald-audit.socket.8.gz
 %{_mandir}/man8/systemd-journald-dev-log.socket.8.gz
 %{_mandir}/man8/systemd-journald-varlink@.socket.8.gz
@@ -440,11 +368,7 @@
 %{_mandir}/man8/systemd-logind.8.gz
 %{_mandir}/man8/systemd-logind.service.8.gz
 %{_mandir}/man8/systemd-machine-id-commit.service.8.gz
-%{_mandir}/man8/systemd-makefs.8.gz
-%{_mandir}/man8/systemd-makefs@.service.8.gz
 %{_mandir}/man8/systemd-mkswap@.service.8.gz
-%{_mandir}/man8/systemd-modules-load.8.gz
-%{_mandir}/man8/systemd-modules-load.service.8.gz
 %{_mandir}/man8/systemd-poweroff.service.8.gz
 %{_mandir}/man8/systemd-quotacheck.8.gz
 %{_mandir}/man8/systemd-quotacheck.service.8.gz
@@ -453,9 +377,6 @@
 %{_mandir}/man8/systemd-reboot.service.8.gz
 %{_mandir}/man8/systemd-remount-fs.8.gz
 %{_mandir}/man8/systemd-remount-fs.service.8.gz
-%{_mandir}/man8/systemd-rfkill.8.gz
-%{_mandir}/man8/systemd-rfkill.service.8.gz
-%{_mandir}/man8/systemd-rfkill.socket.8.gz
 %{_mandir}/man8/systemd-run-generator.8.gz
 %{_mandir}/man8/systemd-shutdown.8.gz
 %{_mandir}/man8/systemd-sleep.8.gz
@@ -477,7 +398,6 @@
 %{_mandir}/man8/systemd-timesyncd.service.8.gz
 %{_mandir}/man8/systemd-tmpfiles-clean.service.8.gz
 %{_mandir}/man8/systemd-tmpfiles-clean.timer.8.gz
-%{_mandir}/man8/systemd-tmpfiles-setup-dev.service.8.gz
 %{_mandir}/man8/systemd-tmpfiles-setup.service.8.gz
 %{_mandir}/man8/systemd-tmpfiles.8.gz
 %{_mandir}/man8/systemd-update-done.8.gz
@@ -488,19 +408,11 @@
 %{_mandir}/man8/systemd-user-sessions.service.8.gz
 %{_mandir}/man8/systemd-vconsole-setup.8.gz
 %{_mandir}/man8/systemd-vconsole-setup.service.8.gz
-%{_mandir}/man8/systemd-veritysetup-generator.8.gz
-%{_mandir}/man8/systemd-veritysetup.8.gz
-%{_mandir}/man8/systemd-veritysetup@.service.8.gz
-%{_mandir}/man8/systemd-volatile-root.8.gz
-%{_mandir}/man8/systemd-volatile-root.service.8.gz
 %{_mandir}/man8/systemd-xdg-autostart-generator.8.gz
 %endif
 %{_modprobedir}/systemd.conf
 %{_pam_moduledir}/pam_systemd.so
 %{_pam_vendordir}/systemd-user
-%{_prefix}/lib/kernel/install.conf
-%{_prefix}/lib/kernel/install.d/50-depmod.install
-%{_prefix}/lib/kernel/install.d/90-loaderentry.install
 %{_sbindir}/halt
 %{_sbindir}/init
 %{_sbindir}/poweroff
@@ -509,12 +421,6 @@
 %{_sysconfdir}/xdg/systemd/user
 %{_sysctldir}/99-sysctl.conf
 %{_systemd_user_env_generator_dir}/30-systemd-environment-d-generator
-%if %{with sd_boot}
-# These are part of the very few exceptions where glob pattern is allowd.
-%{_systemd_util_dir}/boot/efi/linux*.efi.stub
-%{_systemd_util_dir}/boot/efi/linux*.elf.stub
-%{_systemd_util_dir}/boot/efi/systemd-boot*.efi
-%endif
 %{_systemd_util_dir}/libsystemd-shared-250.so
 %{_systemd_util_dir}/ntp-units.d/80-systemd-timesync.list
 %{_systemd_util_dir}/scripts/migrate-sysconfig-i18n.sh
@@ -522,33 +428,19 @@
 %{_systemd_util_dir}/system-preset/99-default.preset
 %{_systemd_util_dir}/systemd
 %{_systemd_util_dir}/systemd-ac-power
-%{_systemd_util_dir}/systemd-backlight
 %{_systemd_util_dir}/systemd-binfmt
-%if %{with sd_boot}
-%{_systemd_util_dir}/systemd-bless-boot
-%endif
 %{_systemd_util_dir}/systemd-boot-check-no-failures
 %{_systemd_util_dir}/systemd-cgroups-agent
-%if ! %{bootstrap}
-%{_systemd_util_dir}/systemd-cryptsetup
-%endif
 %{_systemd_util_dir}/systemd-fsck
-%{_systemd_util_dir}/systemd-growfs
 %{_systemd_util_dir}/systemd-hibernate-resume
 %{_systemd_util_dir}/systemd-hostnamed
-%if ! %{bootstrap}
-%{_systemd_util_dir}/systemd-integritysetup
-%endif
 %{_systemd_util_dir}/systemd-journald
 %{_systemd_util_dir}/systemd-localed
 %{_systemd_util_dir}/systemd-logind
-%{_systemd_util_dir}/systemd-makefs
-%{_systemd_util_dir}/systemd-modules-load
 %{_systemd_util_dir}/systemd-quotacheck
 %{_systemd_util_dir}/systemd-random-seed
 %{_systemd_util_dir}/systemd-remount-fs
 %{_systemd_util_dir}/systemd-reply-password
-%{_systemd_util_dir}/systemd-rfkill
 %{_systemd_util_dir}/systemd-shutdown
 %{_systemd_util_dir}/systemd-sleep
 %{_systemd_util_dir}/systemd-socket-proxyd
@@ -562,10 +454,6 @@
 %{_systemd_util_dir}/systemd-user-runtime-dir
 %{_systemd_util_dir}/systemd-user-sessions
 %{_systemd_util_dir}/systemd-vconsole-setup
-%if ! %{bootstrap}
-%{_systemd_util_dir}/systemd-veritysetup
-%endif
-%{_systemd_util_dir}/systemd-volatile-root
 %{_systemd_util_dir}/systemd-xdg-autostart-condition
 %{_systemd_util_dir}/user-generators/systemd-xdg-autostart-generator
 %{_systemd_util_dir}/user-preset/90-systemd.preset
@@ -591,25 +479,11 @@
 %{_systemd_util_dir}/user/systemd-tmpfiles-setup.service
 %{_systemd_util_dir}/user/timers.target
 %{_systemd_util_dir}/user/xdg-desktop-autostart.target
-%if %{with sd_boot}
-%{_systemdgeneratordir}/systemd-bless-boot-generator
-%endif
-%if ! %{bootstrap}
-%{_systemdgeneratordir}/systemd-cryptsetup-generator
-%endif
 %{_systemdgeneratordir}/systemd-debug-generator
-%{_systemdgeneratordir}/systemd-fstab-generator
 %{_systemdgeneratordir}/systemd-getty-generator
-%{_systemdgeneratordir}/systemd-gpt-auto-generator
 %{_systemdgeneratordir}/systemd-hibernate-resume-generator
-%if ! %{bootstrap}
-%{_systemdgeneratordir}/systemd-integritysetup-generator
-%endif
 %{_systemdgeneratordir}/systemd-run-generator
 %{_systemdgeneratordir}/systemd-system-update-generator
-%if ! %{bootstrap}
-%{_systemdgeneratordir}/systemd-veritysetup-generator
-%endif
 %{_sysusersdir}/systemd-journal.conf
 %if %{with networkd}
 # Yes, systemd-network.conf really belongs here, see
@@ -635,10 +509,6 @@
 %{_unitdir}/boot-complete.target
 %{_unitdir}/console-getty.service
 %{_unitdir}/container-getty@.service
-%if ! %{bootstrap}
-%{_unitdir}/cryptsetup-pre.target
-%{_unitdir}/cryptsetup.target
-%endif
 %{_unitdir}/ctrl-alt-del.target
 %{_unitdir}/dbus-org.freedesktop.hostname1.service
 %{_unitdir}/dbus-org.freedesktop.locale1.service
@@ -665,19 +535,11 @@
 %{_unitdir}/initrd-fs.target
 %{_unitdir}/initrd-parse-etc.service
 %{_unitdir}/initrd-root-device.target
-%if ! %{bootstrap}
-%{_unitdir}/initrd-root-device.target.wants/remote-cryptsetup.target
-%{_unitdir}/initrd-root-device.target.wants/remote-veritysetup.target
-%endif
 %{_unitdir}/initrd-root-fs.target
 %{_unitdir}/initrd-switch-root.service
 %{_unitdir}/initrd-switch-root.target
 %{_unitdir}/initrd-usr-fs.target
 %{_unitdir}/initrd.target
-%if ! %{bootstrap}
-%{_unitdir}/integritysetup-pre.target
-%{_unitdir}/integritysetup.target
-%endif
 %{_unitdir}/kexec.target
 %{_unitdir}/local-fs-pre.target
 %{_unitdir}/local-fs.target
@@ -700,14 +562,8 @@
 %{_unitdir}/proc-sys-fs-binfmt_misc.mount
 %{_unitdir}/quotaon.service
 %{_unitdir}/reboot.target
-%if ! %{bootstrap}
-%{_unitdir}/remote-cryptsetup.target
-%endif
 %{_unitdir}/remote-fs-pre.target
 %{_unitdir}/remote-fs.target
-%if ! %{bootstrap}
-%{_unitdir}/remote-veritysetup.target
-%endif
 %{_unitdir}/rescue.service
 %{_unitdir}/rescue.target
 %{_unitdir}/rpcbind.target
@@ -729,14 +585,8 @@
 %{_unitdir}/sys-kernel-debug.mount
 %{_unitdir}/sys-kernel-tracing.mount
 %{_unitdir}/sysinit.target
-%if ! %{bootstrap}
-%{_unitdir}/sysinit.target.wants/cryptsetup.target
-%endif
 %{_unitdir}/sysinit.target.wants/dev-hugepages.mount
 %{_unitdir}/sysinit.target.wants/dev-mqueue.mount
-%if ! %{bootstrap}
-%{_unitdir}/sysinit.target.wants/integritysetup.target
-%endif
 %{_unitdir}/sysinit.target.wants/proc-sys-fs-binfmt_misc.automount
 %{_unitdir}/sysinit.target.wants/sys-fs-fuse-connections.mount
 %{_unitdir}/sysinit.target.wants/sys-kernel-config.mount
@@ -744,29 +594,18 @@
 %{_unitdir}/sysinit.target.wants/sys-kernel-tracing.mount
 %{_unitdir}/sysinit.target.wants/systemd-ask-password-console.path
 %{_unitdir}/sysinit.target.wants/systemd-binfmt.service
-%if %{with sd_boot}
-%{_unitdir}/sysinit.target.wants/systemd-boot-system-token.service
-%endif
 %{_unitdir}/sysinit.target.wants/systemd-firstboot.service
 %{_unitdir}/sysinit.target.wants/systemd-journal-catalog-update.service
 %{_unitdir}/sysinit.target.wants/systemd-journal-flush.service
 %{_unitdir}/sysinit.target.wants/systemd-journald.service
 %{_unitdir}/sysinit.target.wants/systemd-machine-id-commit.service
-%{_unitdir}/sysinit.target.wants/systemd-modules-load.service
 %{_unitdir}/sysinit.target.wants/systemd-random-seed.service
 %{_unitdir}/sysinit.target.wants/systemd-sysctl.service
 %{_unitdir}/sysinit.target.wants/systemd-sysusers.service
-%{_unitdir}/sysinit.target.wants/systemd-tmpfiles-setup-dev.service
 %{_unitdir}/sysinit.target.wants/systemd-tmpfiles-setup.service
 %{_unitdir}/sysinit.target.wants/systemd-update-done.service
 %{_unitdir}/sysinit.target.wants/systemd-update-utmp.service
-%if ! %{bootstrap}
-%{_unitdir}/sysinit.target.wants/veritysetup.target
-%endif
 %{_unitdir}/syslog.socket
-%if ! %{bootstrap}
-%{_unitdir}/system-systemd\x2dcryptsetup.slice
-%endif
 %{_unitdir}/system-update-cleanup.service
 %{_unitdir}/system-update-pre.target
 %{_unitdir}/system-update.target
@@ -774,16 +613,8 @@
 %{_unitdir}/systemd-ask-password-console.service
 %{_unitdir}/systemd-ask-password-wall.path
 %{_unitdir}/systemd-ask-password-wall.service
-%{_unitdir}/systemd-backlight@.service
 %{_unitdir}/systemd-binfmt.service
-%if %{with sd_boot}
-%{_unitdir}/systemd-bless-boot.service
-%endif
 %{_unitdir}/systemd-boot-check-no-failures.service
-%if %{with sd_boot}
-%{_unitdir}/systemd-boot-system-token.service
-%{_unitdir}/systemd-boot-update.service
-%endif
 %{_unitdir}/systemd-exit.service
 %{_unitdir}/systemd-firstboot.service
 %{_unitdir}/systemd-fsck-root.service
@@ -805,14 +636,11 @@
 %{_unitdir}/systemd-localed.service
 %{_unitdir}/systemd-logind.service
 %{_unitdir}/systemd-machine-id-commit.service
-%{_unitdir}/systemd-modules-load.service
 %{_unitdir}/systemd-poweroff.service
 %{_unitdir}/systemd-quotacheck.service
 %{_unitdir}/systemd-random-seed.service
 %{_unitdir}/systemd-reboot.service
 %{_unitdir}/systemd-remount-fs.service
-%{_unitdir}/systemd-rfkill.service
-%{_unitdir}/systemd-rfkill.socket
 %{_unitdir}/systemd-suspend-then-hibernate.service
 %{_unitdir}/systemd-suspend.service
 %{_unitdir}/systemd-sysctl.service
@@ -823,13 +651,11 @@
 %{_unitdir}/systemd-timesyncd.service
 %{_unitdir}/systemd-tmpfiles-clean.service
 %{_unitdir}/systemd-tmpfiles-clean.timer
-%{_unitdir}/systemd-tmpfiles-setup-dev.service
 %{_unitdir}/systemd-tmpfiles-setup.service
 %{_unitdir}/systemd-update-done.service
 %{_unitdir}/systemd-update-utmp.service
 %{_unitdir}/systemd-user-sessions.service
 %{_unitdir}/systemd-vconsole-setup.service
-%{_unitdir}/systemd-volatile-root.service
 %{_unitdir}/time-set.target
 %{_unitdir}/time-sync.target
 %{_unitdir}/timers.target
@@ -842,10 +668,6 @@
 %{_unitdir}/user-runtime-dir@.service
 %{_unitdir}/user.slice
 %{_unitdir}/user@.service
-%if ! %{bootstrap}
-%{_unitdir}/veritysetup-pre.target
-%{_unitdir}/veritysetup.target
-%endif
 %{xinitconfdir}/xinitrc.d/50-systemd-user.sh
 %if %{with split_usr}
 /bin/systemctl
diff --git a/files.udev b/files.udev
index 52a309e6..273dd04f 100644
--- a/files.udev
+++ b/files.udev
@@ -2,7 +2,14 @@
 # Please keep the list sorted (with `LC_ALL=C sort`).
 #
 %config(noreplace) %{_sysconfdir}/udev/udev.conf
+%if ! %{bootstrap}
+# %%dir %{_libdir}/cryptsetup
+%dir %{_modulesloaddir}
+%endif
 %dir %{_prefix}/lib/udev
+%if ! %{bootstrap}
+%dir %{_sysconfdir}/modules-load.d
+%endif
 %dir %{_sysconfdir}/udev
 %dir %{_sysconfdir}/udev/rules.d
 %dir %{_systemd_util_dir}/network
@@ -12,6 +19,10 @@
 %doc %{_udevrulesdir}/README
 %ghost %attr(444, root, root) %{_sysconfdir}/udev/hwdb.bin
 %ghost %attr(644, root, root) %{_prefix}/lib/udev/compat-symlink-generation
+%ghost %{_localstatedir}/lib/systemd/backlight
+%if ! %{bootstrap}
+%{_bindir}/systemd-cryptenroll
+%endif
 %{_bindir}/systemd-hwdb
 %{_bindir}/udevadm
 %if ! %{bootstrap}
@@ -22,17 +33,50 @@
 %{_datadir}/zsh/site-functions/_udevadm
 %endif
 %if ! %{bootstrap}
+# %%{_libdir}/cryptsetup/libcryptsetup-token-systemd-fido2.so
+# %%{_libdir}/cryptsetup/libcryptsetup-token-systemd-pkcs11.so
+# %%{_libdir}/cryptsetup/libcryptsetup-token-systemd-tpm2.so
+%{_mandir}/man1/systemd-cryptenroll.1.gz
+%{_mandir}/man5/crypttab.5.gz
+%{_mandir}/man5/integritytab.5.gz
+%{_mandir}/man5/modules-load.d.5.gz
 %{_mandir}/man5/udev.conf.5.gz
+%{_mandir}/man5/veritytab.5.gz
 %{_mandir}/man7/hwdb.7.gz
 %{_mandir}/man7/udev.7.gz
+%{_mandir}/man8/systemd-backlight.8.gz
+%{_mandir}/man8/systemd-backlight@.service.8.gz
+%{_mandir}/man8/systemd-cryptsetup-generator.8.gz
+%{_mandir}/man8/systemd-cryptsetup.8.gz
+%{_mandir}/man8/systemd-cryptsetup@.service.8.gz
+%{_mandir}/man8/systemd-fstab-generator.8.gz
+%{_mandir}/man8/systemd-gpt-auto-generator.8.gz
+%{_mandir}/man8/systemd-growfs.8.gz
+%{_mandir}/man8/systemd-growfs@.service.8.gz
 %{_mandir}/man8/systemd-hwdb.8.gz
+%{_mandir}/man8/systemd-integritysetup-generator.8.gz
+%{_mandir}/man8/systemd-integritysetup.8.gz
+%{_mandir}/man8/systemd-integritysetup@.service.8.gz
+%{_mandir}/man8/systemd-makefs.8.gz
+%{_mandir}/man8/systemd-makefs@.service.8.gz
+%{_mandir}/man8/systemd-modules-load.8.gz
+%{_mandir}/man8/systemd-modules-load.service.8.gz
 %{_mandir}/man8/systemd-network-generator.8.gz
 %{_mandir}/man8/systemd-network-generator.service.8.gz
+%{_mandir}/man8/systemd-rfkill.8.gz
+%{_mandir}/man8/systemd-rfkill.service.8.gz
+%{_mandir}/man8/systemd-rfkill.socket.8.gz
+%{_mandir}/man8/systemd-tmpfiles-setup-dev.service.8.gz
 %{_mandir}/man8/systemd-udev-settle.service.8.gz
 %{_mandir}/man8/systemd-udevd-control.socket.8.gz
 %{_mandir}/man8/systemd-udevd-kernel.socket.8.gz
 %{_mandir}/man8/systemd-udevd.8.gz
 %{_mandir}/man8/systemd-udevd.service.8.gz
+%{_mandir}/man8/systemd-veritysetup-generator.8.gz
+%{_mandir}/man8/systemd-veritysetup.8.gz
+%{_mandir}/man8/systemd-veritysetup@.service.8.gz
+%{_mandir}/man8/systemd-volatile-root.8.gz
+%{_mandir}/man8/systemd-volatile-root.service.8.gz
 %{_mandir}/man8/udevadm.8.gz
 %endif
 %{_prefix}/lib/udev/ata_id
@@ -47,8 +91,34 @@
 %{_prefix}/lib/udev/scsi_id
 %{_prefix}/lib/udev/v4l_id
 %{_systemd_util_dir}/network/99-default.link
+%{_systemd_util_dir}/systemd-backlight
+%if ! %{bootstrap}
+%{_systemd_util_dir}/systemd-cryptsetup
+%endif
+%{_systemd_util_dir}/systemd-growfs
+%if ! %{bootstrap}
+%{_systemd_util_dir}/systemd-integritysetup
+%endif
+%{_systemd_util_dir}/systemd-makefs
+%if ! %{bootstrap}
+%{_systemd_util_dir}/systemd-modules-load
+%endif
 %{_systemd_util_dir}/systemd-network-generator
+%{_systemd_util_dir}/systemd-rfkill
 %{_systemd_util_dir}/systemd-udevd
+%if ! %{bootstrap}
+%{_systemd_util_dir}/systemd-veritysetup
+%endif
+%{_systemd_util_dir}/systemd-volatile-root
+%if ! %{bootstrap}
+%{_systemdgeneratordir}/systemd-cryptsetup-generator
+%endif
+%{_systemdgeneratordir}/systemd-fstab-generator
+%{_systemdgeneratordir}/systemd-gpt-auto-generator
+%if ! %{bootstrap}
+%{_systemdgeneratordir}/systemd-integritysetup-generator
+%{_systemdgeneratordir}/systemd-veritysetup-generator
+%endif
 %{_tmpfilesdir}/static-nodes-permissions.conf
 %{_udevhwdbdir}/20-OUI.hwdb
 %{_udevhwdbdir}/20-acpi-vendor.hwdb
@@ -105,25 +175,63 @@
 %{_udevrulesdir}/75-net-description.rules
 %{_udevrulesdir}/75-probe_mtd.rules
 %{_udevrulesdir}/78-sound-card.rules
+%if ! %{bootstrap}
 %{_udevrulesdir}/80-drivers.rules
+%endif
 %{_udevrulesdir}/80-net-setup-link.rules
 %{_udevrulesdir}/81-net-dhcp.rules
 %{_udevrulesdir}/90-vconsole.rules
+%if ! %{bootstrap}
+%{_unitdir}/cryptsetup-pre.target
+%{_unitdir}/cryptsetup.target
+%{_unitdir}/initrd-root-device.target.wants/remote-cryptsetup.target
+%{_unitdir}/initrd-root-device.target.wants/remote-veritysetup.target
+%endif
 %{_unitdir}/initrd-udevadm-cleanup-db.service
+%if ! %{bootstrap}
+%{_unitdir}/integritysetup-pre.target
+%{_unitdir}/integritysetup.target
 %{_unitdir}/kmod-static-nodes.service
+%{_unitdir}/remote-cryptsetup.target
+%{_unitdir}/remote-veritysetup.target
+%endif
 %{_unitdir}/sockets.target.wants/systemd-udevd-control.socket
 %{_unitdir}/sockets.target.wants/systemd-udevd-kernel.socket
+%if ! %{bootstrap}
+%{_unitdir}/sysinit.target.wants/cryptsetup.target
+%{_unitdir}/sysinit.target.wants/integritysetup.target
 %{_unitdir}/sysinit.target.wants/kmod-static-nodes.service
+%endif
 %{_unitdir}/sysinit.target.wants/systemd-hwdb-update.service
+%if ! %{bootstrap}
+%{_unitdir}/sysinit.target.wants/systemd-modules-load.service
+%endif
+%{_unitdir}/sysinit.target.wants/systemd-tmpfiles-setup-dev.service
 %{_unitdir}/sysinit.target.wants/systemd-udev-trigger.service
 %{_unitdir}/sysinit.target.wants/systemd-udevd.service
+%if ! %{bootstrap}
+%{_unitdir}/sysinit.target.wants/veritysetup.target
+%{_unitdir}/system-systemd\x2dcryptsetup.slice
+%endif
+%{_unitdir}/systemd-backlight@.service
 %{_unitdir}/systemd-hwdb-update.service
+%if ! %{bootstrap}
+%{_unitdir}/systemd-modules-load.service
+%endif
 %{_unitdir}/systemd-network-generator.service
+%{_unitdir}/systemd-rfkill.service
+%{_unitdir}/systemd-rfkill.socket
+%{_unitdir}/systemd-tmpfiles-setup-dev.service
 %{_unitdir}/systemd-udev-settle.service
 %{_unitdir}/systemd-udev-trigger.service
 %{_unitdir}/systemd-udevd-control.socket
 %{_unitdir}/systemd-udevd-kernel.socket
 %{_unitdir}/systemd-udevd.service
+%{_unitdir}/systemd-volatile-root.service
+%if ! %{bootstrap}
+%{_unitdir}/veritysetup-pre.target
+%{_unitdir}/veritysetup.target
+%endif
 %if %{with split_usr}
 /sbin/udevadm
 %endif
diff --git a/files.uefi-boot b/files.uefi-boot
new file mode 100644
index 00000000..49bcdfec
--- /dev/null
+++ b/files.uefi-boot
@@ -0,0 +1,43 @@
+#
+# Please keep the list sorted (with `LC_ALL=C sort`).
+#
+%if %{with sd_boot}
+%dir %{_prefix}/lib/kernel
+%dir %{_prefix}/lib/kernel/install.d
+%dir %{_systemd_util_dir}/boot
+%dir %{_systemd_util_dir}/boot/efi
+%{_bindir}/bootctl
+%{_bindir}/kernel-install
+%if ! %{bootstrap}
+%{_datadir}/bash-completion/completions/bootctl
+%{_datadir}/bash-completion/completions/kernel-install
+%{_datadir}/zsh/site-functions/_bootctl
+%{_datadir}/zsh/site-functions/_kernel-install
+%{_mandir}/man1/bootctl.1.gz
+%{_mandir}/man5/loader.conf.5.gz
+%{_mandir}/man7/linuxaa64.efi.stub.7.gz
+%{_mandir}/man7/linuxia32.efi.stub.7.gz
+%{_mandir}/man7/linuxx64.efi.stub.7.gz
+%{_mandir}/man7/sd-boot.7.gz
+%{_mandir}/man7/systemd-boot.7.gz
+%{_mandir}/man7/systemd-stub.7.gz
+%{_mandir}/man8/kernel-install.8.gz
+%{_mandir}/man8/systemd-bless-boot-generator.8.gz
+%{_mandir}/man8/systemd-bless-boot.8.gz
+%{_mandir}/man8/systemd-bless-boot.service.8.gz
+%{_mandir}/man8/systemd-boot-system-token.service.8.gz
+%endif
+%{_prefix}/lib/kernel/install.conf
+%{_prefix}/lib/kernel/install.d/50-depmod.install
+%{_prefix}/lib/kernel/install.d/90-loaderentry.install
+# These are part of the very few exceptions where glob pattern is allowd.
+%{_systemd_util_dir}/boot/efi/linux*.efi.stub
+%{_systemd_util_dir}/boot/efi/linux*.elf.stub
+%{_systemd_util_dir}/boot/efi/systemd-boot*.efi
+%{_systemd_util_dir}/systemd-bless-boot
+%{_systemdgeneratordir}/systemd-bless-boot-generator
+%{_unitdir}/sysinit.target.wants/systemd-boot-system-token.service
+%{_unitdir}/systemd-bless-boot.service
+%{_unitdir}/systemd-boot-system-token.service
+%{_unitdir}/systemd-boot-update.service
+%endif
diff --git a/systemd.changes b/systemd.changes
index e8567d8a..05c8d8ec 100644
--- a/systemd.changes
+++ b/systemd.changes
@@ -1,3 +1,33 @@
+-------------------------------------------------------------------
+Thu Mar 31 12:03:19 UTC 2022 - Franck Bui <fbui@suse.com>
+
+- Temporarily disable 'libcryptsetup plugins until dracut 056 is merged in
+  Factory
+
+-------------------------------------------------------------------
+Thu Mar 31 11:22:12 UTC 2022 - Franck Bui <fbui@suse.com>
+
+- Add 0001-meson-build-kernel-install-man-page-when-necessary.patch
+
+  Submitted to upstream: https://github.com/systemd/systemd/pull/22918
+
+-------------------------------------------------------------------
+Mon Mar 28 18:36:39 UTC 2022 - Franck Bui <fbui@suse.com>
+
+- Move systemd-boot and all components managing (secure) UEFI boot into udev
+  sub-package: they may deserve a dedicated sub-package in the future but for
+  now move them to udev so they aren't installed in systemd based containers.
+
+- Move a bunch of components operating on (mainly block) devices into udev as
+  without udev they're most likely useless.
+
+-------------------------------------------------------------------
+Mon Mar 28 17:02:04 UTC 2022 - Franck Bui <fbui@suse.com>
+
+- spec: enable 'efi' support regardless of whether sd_boot is enabled or not
+
+  We should support EFI systems even if systemd-boot is not enabled.
+
 -------------------------------------------------------------------
 Wed Mar 23 15:17:40 UTC 2022 - Franck Bui <fbui@suse.com>
 
diff --git a/systemd.spec b/systemd.spec
index 464b6839..355fa44a 100644
--- a/systemd.spec
+++ b/systemd.spec
@@ -87,9 +87,7 @@ BuildRequires:  polkit
 BuildRequires:  python3-base
 BuildRequires:  python3-lxml
 BuildRequires:  pkgconfig(audit)
-BuildRequires:  pkgconfig(libcryptsetup) >= 1.6.0
 BuildRequires:  pkgconfig(libdw)
-BuildRequires:  pkgconfig(libfido2)
 BuildRequires:  pkgconfig(libiptc)
 BuildRequires:  pkgconfig(liblz4)
 BuildRequires:  pkgconfig(liblzma)
@@ -97,9 +95,6 @@ BuildRequires:  pkgconfig(libpcre2-8)
 BuildRequires:  pkgconfig(libqrencode)
 BuildRequires:  pkgconfig(libselinux) >= 2.1.9
 BuildRequires:  pkgconfig(libzstd)
-BuildRequires:  pkgconfig(tss2-esys)
-BuildRequires:  pkgconfig(tss2-mu)
-BuildRequires:  pkgconfig(tss2-rc)
 %ifarch aarch64 %ix86 x86_64 x32 %arm ppc64le s390x
 BuildRequires:  pkgconfig(libseccomp) >= 2.3.1
 %endif
@@ -117,20 +112,7 @@ BuildRequires:  python3-jinja2
 BuildRequires:  suse-module-tools >= 12.4
 BuildRequires:  systemd-rpm-macros
 BuildRequires:  pkgconfig(blkid) >= 2.26
-BuildRequires:  pkgconfig(libkmod) >= 15
 BuildRequires:  pkgconfig(libpci) >= 3
-%if %{with importd}
-BuildRequires:  pkgconfig(bzip2)
-BuildRequires:  pkgconfig(libcurl)
-BuildRequires:  pkgconfig(zlib)
-%endif
-%if %{with journal_remote}
-BuildRequires:  pkgconfig(libcurl)
-BuildRequires:  pkgconfig(libmicrohttpd) >= 0.9.33
-%endif
-%if %{with sd_boot}
-BuildRequires:  gnu-efi
-%endif
 
 %if %{bootstrap}
 #!BuildIgnore:  dbus-1
@@ -156,11 +138,6 @@ Requires:       util-linux >= 2.27.1
 Requires:       group(lock)
 # This Recommends because some symbols of libpcre2 are dlopen()ed by journalctl
 Recommends:     libpcre2-8-0
-# ditto but dlopen()ed by systemd-cryptenroll
-Recommends:     libfido2
-Recommends:     libtss2-esys0
-Recommends:     libtss2-mu0
-Recommends:     libtss2-rc0
 Requires(post): coreutils
 Requires(post): findutils
 Requires(post): systemd-presets-branding
@@ -201,6 +178,7 @@ Source202:      files.container
 Source203:      files.network
 Source204:      files.devel
 Source205:      files.sysvcompat
+Source206:      files.uefi-boot
 
 #
 # All changes backported from upstream are tracked by the git repository, which
@@ -231,6 +209,7 @@ Patch1000:      1000-Revert-getty-Pass-tty-to-use-by-agetty-via-stdin.patch
 # upstream and need an urgent fix. Even in this case, the patches are
 # temporary and should be removed as soon as a fix is merged by
 # upstream.
+Patch6000:      0001-meson-build-kernel-install-man-page-when-necessary.patch
 
 %description
 Systemd is a system and service manager, compatible with SysV and LSB
@@ -328,6 +307,9 @@ This library provides several of the systemd C APIs:
 Summary:        A rule-based device node and kernel event manager
 License:        GPL-2.0-only
 URL:            http://www.kernel.org/pub/linux/utils/kernel/hotplug/udev.html
+%if %{with sd_boot}
+BuildRequires:  gnu-efi
+%endif
 Requires:       %{name} = %{version}-%{release}
 %systemd_requires
 Requires:       filesystem
@@ -337,6 +319,22 @@ Requires:       group(kvm)
 Requires(post): sed
 Requires(post): coreutils
 Requires(postun):coreutils
+%if ! %{bootstrap}
+BuildRequires:  pkgconfig(libcryptsetup) >= 1.6.0
+BuildRequires:  pkgconfig(libkmod) >= 15
+# Enable fido2 and tpm supports in systemd-cryptsetup, systemd-enroll. However
+# these tools are not linked against the libs directly but instead are
+# dlopen()ed at runtime to avoid hard dependencies. Hence the use of soft
+# dependencies.
+BuildRequires:  pkgconfig(libfido2)
+BuildRequires:  pkgconfig(tss2-esys)
+BuildRequires:  pkgconfig(tss2-mu)
+BuildRequires:  pkgconfig(tss2-rc)
+Recommends:     libfido2
+Recommends:     libtss2-esys0
+Recommends:     libtss2-mu0
+Recommends:     libtss2-rc0
+%endif
 Conflicts:      ConsoleKit < 0.4.1
 Conflicts:      dracut < 044.1
 Conflicts:      filesystem < 11.5
@@ -385,6 +383,11 @@ This package contains systemd-coredump, coredumpctl.
 %package container
 Summary:        Systemd tools for container management
 License:        LGPL-2.1-or-later
+%if %{with importd}
+BuildRequires:  pkgconfig(bzip2)
+BuildRequires:  pkgconfig(libcurl)
+BuildRequires:  pkgconfig(zlib)
+%endif
 Requires:       %{name} = %{version}-%{release}
 %systemd_requires
 Obsoletes:      nss-mymachines < %{version}-%{release}
@@ -494,6 +497,8 @@ To activate this NSS module, you will need to include it in
 %package journal-remote
 Summary:        Gateway for serving journal events over the network using HTTP
 License:        LGPL-2.1-or-later
+BuildRequires:  pkgconfig(libcurl)
+BuildRequires:  pkgconfig(libmicrohttpd) >= 0.9.33
 Requires:       %{name} = %{version}-%{release}
 %systemd_requires
 
@@ -675,16 +680,20 @@ Have fun with these services at your own risk.
         -Delfutils=auto \
         -Doomd=false \
 %if %{bootstrap}
+        -Defi=false \
         -Dbashcompletiondir=no \
         -Dzshcompletiondir=no \
         -Dtranslations=false \
         -Dnss-myhostname=false \
         -Dnss-systemd=false \
 %else
+        -Defi=true \
+        -Dtpm=true \
         -Dtpm2=true \
         -Dman=true \
         -Dhtml=true \
 %endif
+        -Dlibcryptsetup-plugins=false \
         -Dcoredump=%{when coredump} \
         -Dimportd=%{when importd} \
         -Dmachined=%{when machined} \
@@ -692,7 +701,7 @@ Have fun with these services at your own risk.
         -Dportabled=%{when portabled} \
         -Dremote=%{when journal_remote} \
 	\
-        -Defi=%{when sd_boot} \
+        -Dkernel-install=%{when sd_boot} \
         -Dgnu-efi=%{when sd_boot} \
         -Dsbat-distro= \
 	\
@@ -994,7 +1003,6 @@ fi
 
 # Create default config in /etc at first install.
 # Later package updates should not overwrite these settings.
-%systemd_post remote-cryptsetup.target
 %systemd_post getty@.service
 %systemd_post machines.target
 %systemd_post remote-fs.target
@@ -1073,6 +1081,8 @@ fi
 %regenerate_initrd_post
 %udev_hwdb_update
 
+%systemd_post remote-cryptsetup.target
+
 # add KERNEL name match to existing persistent net rules
 sed -ri '/KERNEL/ ! { s/NAME="(eth|wlan|ath)([0-9]+)"/KERNEL=="\1*", NAME="\1\2"/}' \
     /etc/udev/rules.d/70-persistent-net.rules 2>/dev/null || :
@@ -1255,6 +1265,7 @@ fi
 %files -n udev%{?mini}
 %defattr(-,root,root)
 %include %{SOURCE201}
+%include %{SOURCE206}
 
 %files container
 %defattr(-,root,root)