diff --git a/TODO b/TODO
index 3a4eac4b2c..b7038ec7c0 100644
--- a/TODO
+++ b/TODO
@@ -23,6 +23,13 @@ Janitorial Clean-ups:
 
 Features:
 
+* make MAINPID= message reception checks even stricter: if service uses User=,
+  then check sending UID and ignore message if it doesn't match the user or
+  root.
+
+* maybe trigger a uevent "change" on a device if "systemctl reload xyz.device"
+  is issued.
+
 * when importing an fs tree with machined, optionally apply userns-rec-chown
 
 * when importing an fs tree with machined, complain if image is not an OS
diff --git a/src/core/cgroup.c b/src/core/cgroup.c
index 2dd53191e0..5590047976 100644
--- a/src/core/cgroup.c
+++ b/src/core/cgroup.c
@@ -2844,23 +2844,22 @@ static int unit_get_cpu_usage_raw(Unit *u, nsec_t *ret) {
         if (unit_has_host_root_cgroup(u))
                 return procfs_cpu_get_usage(ret);
 
-        r = cg_all_unified();
-        if (r < 0)
-                return r;
-
         /* Requisite controllers for CPU accounting are not enabled */
         if ((get_cpu_accounting_mask() & ~u->cgroup_realized_mask) != 0)
                 return -ENODATA;
 
+        r = cg_all_unified();
+        if (r < 0)
+                return r;
         if (r > 0) {
                 _cleanup_free_ char *val = NULL;
                 uint64_t us;
 
                 r = cg_get_keyed_attribute("cpu", u->cgroup_path, "cpu.stat", STRV_MAKE("usage_usec"), &val);
-                if (r < 0)
-                        return r;
                 if (IN_SET(r, -ENOENT, -ENXIO))
                         return -ENODATA;
+                if (r < 0)
+                        return r;
 
                 r = safe_atou64(val, &us);
                 if (r < 0)