diff --git a/src/basic/path-lookup.c b/src/basic/path-lookup.c
index ba5c2c47b94..05eb17d66cc 100644
--- a/src/basic/path-lookup.c
+++ b/src/basic/path-lookup.c
@@ -36,35 +36,33 @@ int xdg_user_runtime_dir(char **ret, const char *suffix) {
 }
 
 int xdg_user_config_dir(char **ret, const char *suffix) {
+        _cleanup_free_ char *j = NULL;
         const char *e;
-        char *j;
         int r;
 
         assert(ret);
 
         e = getenv("XDG_CONFIG_HOME");
-        if (e)
+        if (e) {
                 j = path_join(e, suffix);
-        else {
-                _cleanup_free_ char *home = NULL;
-
-                r = get_home_dir(&home);
+                if (!j)
+                        return -ENOMEM;
+        } else {
+                r = get_home_dir(&j);
                 if (r < 0)
                         return r;
 
-                j = path_join(home, "/.config", suffix);
+                if (!path_extend(&j, "/.config", suffix))
+                        return -ENOMEM;
         }
 
-        if (!j)
-                return -ENOMEM;
-
-        *ret = j;
+        *ret = TAKE_PTR(j);
         return 0;
 }
 
 int xdg_user_data_dir(char **ret, const char *suffix) {
+        _cleanup_free_ char *j = NULL;
         const char *e;
-        char *j;
         int r;
 
         assert(ret);
@@ -75,21 +73,20 @@ int xdg_user_data_dir(char **ret, const char *suffix) {
          * /etc/systemd/ anyway. */
 
         e = getenv("XDG_DATA_HOME");
-        if (e)
+        if (e) {
                 j = path_join(e, suffix);
-        else {
-                _cleanup_free_ char *home = NULL;
-
-                r = get_home_dir(&home);
+                if (!j)
+                        return -ENOMEM;
+        } else {
+                r = get_home_dir(&j);
                 if (r < 0)
                         return r;
 
-                j = path_join(home, "/.local/share", suffix);
+                if (!path_extend(&j, "/.local/share", suffix))
+                        return -ENOMEM;
         }
-        if (!j)
-                return -ENOMEM;
 
-        *ret = j;
+        *ret = TAKE_PTR(j);
         return 1;
 }
 
diff --git a/src/basic/path-util.c b/src/basic/path-util.c
index f98859939cd..28b2c66b6ef 100644
--- a/src/basic/path-util.c
+++ b/src/basic/path-util.c
@@ -548,18 +548,22 @@ bool path_equal_filename(const char *a, const char *b) {
         return path_equal(a_basename, b_basename);
 }
 
-char* path_join_internal(const char *first, ...) {
-        char *joined, *q;
+char* path_extend_internal(char **x, ...) {
+        size_t sz, old_sz;
+        char *q, *nx;
         const char *p;
         va_list ap;
         bool slash;
-        size_t sz;
 
         /* Joins all listed strings until the sentinel and places a "/" between them unless the strings end/begin
          * already with one so that it is unnecessary. Note that slashes which are already duplicate won't be
          * removed. The string returned is hence always equal to or longer than the sum of the lengths of each
          * individual string.
          *
+         * The first argument may be an already allocated string that is extended via realloc() if
+         * non-NULL. path_extend() and path_join() are macro wrappers around this function, making use of the
+         * first parameter to distinguish the two operations.
+         *
          * Note: any listed empty string is simply skipped. This can be useful for concatenating strings of which some
          * are optional.
          *
@@ -569,28 +573,39 @@ char* path_join_internal(const char *first, ...) {
          * path_join("foo/", "bar") → "foo/bar"
          * path_join("", "foo", "", "bar", "") → "foo/bar" */
 
-        sz = strlen_ptr(first);
-        va_start(ap, first);
-        while ((p = va_arg(ap, char*)) != POINTER_MAX)
-                if (!isempty(p))
-                        sz += 1 + strlen(p);
+        sz = old_sz = x ? strlen_ptr(*x) : 0;
+        va_start(ap, x);
+        while ((p = va_arg(ap, char*)) != POINTER_MAX) {
+                size_t add;
+
+                if (isempty(p))
+                        continue;
+
+                add = 1 + strlen(p);
+                if (sz > SIZE_MAX - add) /* overflow check */
+                        return NULL;
+
+                sz += add;
+        }
+
         va_end(ap);
 
-        joined = new(char, sz + 1);
-        if (!joined)
+        nx = realloc(x ? *x : NULL, GREEDY_ALLOC_ROUND_UP(sz+1));
+        if (!nx)
                 return NULL;
+        if (x)
+                *x = nx;
 
-        if (!isempty(first)) {
-                q = stpcpy(joined, first);
-                slash = endswith(first, "/");
-        } else {
-                /* Skip empty items */
-                joined[0] = 0;
-                q = joined;
+        if (old_sz > 0)
+                slash = nx[old_sz] == '/';
+        else {
+                nx[old_sz] = 0;
                 slash = true; /* no need to generate a slash anymore */
         }
 
-        va_start(ap, first);
+        q = nx + old_sz;
+
+        va_start(ap, x);
         while ((p = va_arg(ap, char*)) != POINTER_MAX) {
                 if (isempty(p))
                         continue;
@@ -603,7 +618,7 @@ char* path_join_internal(const char *first, ...) {
         }
         va_end(ap);
 
-        return joined;
+        return nx;
 }
 
 static int check_x_access(const char *path, int *ret_fd) {
@@ -666,7 +681,7 @@ int find_executable_full(const char *name, bool use_path_envvar, char **ret_file
 
         /* Resolve a single-component name to a full path */
         for (;;) {
-                _cleanup_free_ char *j = NULL, *element = NULL;
+                _cleanup_free_ char *element = NULL;
                 _cleanup_close_ int fd = -1;
 
                 r = extract_first_word(&p, &element, ":", EXTRACT_RELAX|EXTRACT_DONT_COALESCE_SEPARATORS);
@@ -678,11 +693,10 @@ int find_executable_full(const char *name, bool use_path_envvar, char **ret_file
                 if (!path_is_absolute(element))
                         continue;
 
-                j = path_join(element, name);
-                if (!j)
+                if (!path_extend(&element, name))
                         return -ENOMEM;
 
-                r = check_x_access(j, ret_fd ? &fd : NULL);
+                r = check_x_access(element, ret_fd ? &fd : NULL);
                 if (r < 0) {
                         /* PATH entries which we don't have access to are ignored, as per tradition. */
                         if (r != -EACCES)
@@ -692,7 +706,7 @@ int find_executable_full(const char *name, bool use_path_envvar, char **ret_file
 
                 /* Found it! */
                 if (ret_filename)
-                        *ret_filename = path_simplify(TAKE_PTR(j), false);
+                        *ret_filename = path_simplify(TAKE_PTR(element), false);
                 if (ret_fd)
                         *ret_fd = TAKE_FD(fd);
 
diff --git a/src/basic/path-util.h b/src/basic/path-util.h
index f82d935dc5c..238a76ea733 100644
--- a/src/basic/path-util.h
+++ b/src/basic/path-util.h
@@ -63,8 +63,10 @@ bool path_equal(const char *a, const char *b) _pure_;
 bool path_equal_or_files_same(const char *a, const char *b, int flags);
 /* Compares only the last portion of the input paths, ie: the filenames */
 bool path_equal_filename(const char *a, const char *b);
-char* path_join_internal(const char *first, ...);
-#define path_join(x, ...) path_join_internal(x, __VA_ARGS__, POINTER_MAX)
+
+char* path_extend_internal(char **x, ...);
+#define path_extend(x, ...) path_extend_internal(x, __VA_ARGS__, POINTER_MAX)
+#define path_join(...) path_extend_internal(NULL, __VA_ARGS__, POINTER_MAX)
 
 char* path_simplify(char *path, bool kill_dots);
 
diff --git a/src/basic/selinux-util.c b/src/basic/selinux-util.c
index 0af541d0b19..30229509b35 100644
--- a/src/basic/selinux-util.c
+++ b/src/basic/selinux-util.c
@@ -524,18 +524,17 @@ int mac_selinux_create_file_prepare_at(int dirfd, const char *path, mode_t mode)
                 return 0;
 
         if (!path_is_absolute(path)) {
-                _cleanup_free_ char *p = NULL;
-
                 if (dirfd == AT_FDCWD)
-                        r = safe_getcwd(&p);
+                        r = safe_getcwd(&abspath);
                 else
-                        r = fd_get_path(dirfd, &p);
+                        r = fd_get_path(dirfd, &abspath);
                 if (r < 0)
                         return r;
 
-                path = abspath = path_join(p, path);
-                if (!path)
+                if (!path_extend(&abspath, path))
                         return -ENOMEM;
+
+                path = abspath;
         }
 
         return selinux_create_file_prepare_abspath(path, mode);
diff --git a/src/basic/tmpfile-util.c b/src/basic/tmpfile-util.c
index c5ae92f985f..9eb654c1407 100644
--- a/src/basic/tmpfile-util.c
+++ b/src/basic/tmpfile-util.c
@@ -123,13 +123,10 @@ int tempfn_xxxxxx(const char *p, const char *extra, char **ret) {
                 return -EINVAL;
 
         if (d)  {
-                char *j;
-
-                j = path_join(d, nf);
-                if (!j)
+                if (!path_extend(&d, nf))
                         return -ENOMEM;
 
-                *ret = path_simplify(j, false);
+                *ret = path_simplify(TAKE_PTR(d), false);
         } else
                 *ret = TAKE_PTR(nf);
 
@@ -168,13 +165,10 @@ int tempfn_random(const char *p, const char *extra, char **ret) {
                 return -EINVAL;
 
         if (d) {
-                char *j;
-
-                j = path_join(d, nf);
-                if (!j)
+                if (!path_extend(&d, nf))
                         return -ENOMEM;
 
-                *ret = path_simplify(j, false);
+                *ret = path_simplify(TAKE_PTR(d), false);
         } else
                 *ret = TAKE_PTR(nf);
 
diff --git a/src/core/execute.c b/src/core/execute.c
index f4201860103..f577b790e6a 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -2287,8 +2287,6 @@ static int setup_exec_directory(
                         goto fail;
 
                 if (exec_directory_is_private(context, type)) {
-                        _cleanup_free_ char *private_root = NULL;
-
                         /* So, here's one extra complication when dealing with DynamicUser=1 units. In that
                          * case we want to avoid leaving a directory around fully accessible that is owned by
                          * a dynamic user whose UID is later on reused. To lock this down we use the same
@@ -2314,19 +2312,18 @@ static int setup_exec_directory(
                          * Also, note that we don't do this for EXEC_DIRECTORY_RUNTIME as that's often used
                          * for sharing files or sockets with other services. */
 
-                        private_root = path_join(params->prefix[type], "private");
-                        if (!private_root) {
+                        pp = path_join(params->prefix[type], "private");
+                        if (!pp) {
                                 r = -ENOMEM;
                                 goto fail;
                         }
 
                         /* First set up private root if it doesn't exist yet, with access mode 0700 and owned by root:root */
-                        r = mkdir_safe_label(private_root, 0700, 0, 0, MKDIR_WARN_MODE);
+                        r = mkdir_safe_label(pp, 0700, 0, 0, MKDIR_WARN_MODE);
                         if (r < 0)
                                 goto fail;
 
-                        pp = path_join(private_root, *rt);
-                        if (!pp) {
+                        if (!path_extend(&pp, *rt)) {
                                 r = -ENOMEM;
                                 goto fail;
                         }
diff --git a/src/libsystemd/sd-path/sd-path.c b/src/libsystemd/sd-path/sd-path.c
index 4fe0903c1d6..ff1e0d5f8e4 100644
--- a/src/libsystemd/sd-path/sd-path.c
+++ b/src/libsystemd/sd-path/sd-path.c
@@ -37,7 +37,6 @@ static int from_environment(const char *envname, const char *fallback, const cha
 
 static int from_home_dir(const char *envname, const char *suffix, char **buffer, const char **ret) {
         _cleanup_free_ char *h = NULL;
-        char *cc = NULL;
         int r;
 
         assert(suffix);
@@ -58,12 +57,11 @@ static int from_home_dir(const char *envname, const char *suffix, char **buffer,
         if (r < 0)
                 return r;
 
-        cc = path_join(h, suffix);
-        if (!cc)
+        if (!path_extend(&h, suffix))
                 return -ENOMEM;
 
-        *buffer = cc;
-        *ret = cc;
+        *buffer = h;
+        *ret = TAKE_PTR(h);
         return 0;
 }
 
@@ -135,18 +133,16 @@ static int from_user_dir(const char *field, char **buffer, const char **ret) {
                 /* Three syntaxes permitted: relative to $HOME, $HOME itself, and absolute path */
                 if (startswith(p, "$HOME/")) {
                         _cleanup_free_ char *h = NULL;
-                        char *cc;
 
                         r = get_home_dir(&h);
                         if (r < 0)
                                 return r;
 
-                        cc = path_join(h, p+5);
-                        if (!cc)
+                        if (!path_extend(&h, p+5))
                                 return -ENOMEM;
 
-                        *buffer = cc;
-                        *ret = cc;
+                        *buffer = h;
+                        *ret = TAKE_PTR(h);
                         return 0;
                 } else if (streq(p, "$HOME")) {
 
@@ -173,20 +169,17 @@ fallback:
         /* The desktop directory defaults to $HOME/Desktop, the others to $HOME */
         if (streq(field, "XDG_DESKTOP_DIR")) {
                 _cleanup_free_ char *h = NULL;
-                char *cc;
 
                 r = get_home_dir(&h);
                 if (r < 0)
                         return r;
 
-                cc = path_join(h, "Desktop");
-                if (!cc)
+                if (!path_extend(&h, "Desktop"))
                         return -ENOMEM;
 
-                *buffer = cc;
-                *ret = cc;
+                *buffer = h;
+                *ret = TAKE_PTR(h);
         } else {
-
                 r = get_home_dir(buffer);
                 if (r < 0)
                         return r;
diff --git a/src/test/test-path-util.c b/src/test/test-path-util.c
index 1572483602c..8091a301e38 100644
--- a/src/test/test-path-util.c
+++ b/src/test/test-path-util.c
@@ -380,6 +380,27 @@ static void test_path_join(void) {
         test_join("//foo////bar////baz//", "//foo/", "///bar/", "///baz//");
 }
 
+static void test_path_extend(void) {
+        _cleanup_free_ char *p = NULL;
+
+        log_info("/* %s */", __func__);
+
+        assert_se(path_extend(&p, "foo", "bar", "baz") == p);
+        assert_se(streq(p, "foo/bar/baz"));
+
+        assert_se(path_extend(&p, "foo", "bar", "baz") == p);
+        assert_se(streq(p, "foo/bar/baz/foo/bar/baz"));
+
+        p = mfree(p);
+        assert_se(path_extend(&p, "foo") == p);
+        assert_se(streq(p, "foo"));
+
+        assert_se(path_extend(&p, "/foo") == p);
+        assert_se(streq(p, "foo/foo"));
+        assert_se(path_extend(&p, "waaaah/wahhh/") == p);
+        assert_se(streq(p, "foo/foo/waaaah/wahhh/"));
+}
+
 static void test_fsck_exists(void) {
         log_info("/* %s */", __func__);
 
@@ -860,6 +881,7 @@ int main(int argc, char **argv) {
         test_find_executable_exec();
         test_prefixes();
         test_path_join();
+        test_path_extend();
         test_fsck_exists();
         test_make_relative();
         test_strv_resolve();