diff --git a/src/basic/fd-util.c b/src/basic/fd-util.c
index ecbe58a9f83..d9ef7ec9326 100644
--- a/src/basic/fd-util.c
+++ b/src/basic/fd-util.c
@@ -900,9 +900,9 @@ int path_is_root_at(int dir_fd, const char *path) {
         assert(dir_fd >= 0 || dir_fd == AT_FDCWD);
 
         if (!isempty(path)) {
-                fd = openat(dir_fd, path, O_PATH|O_CLOEXEC);
+                fd = openat(dir_fd, path, O_PATH|O_DIRECTORY|O_CLOEXEC);
                 if (fd < 0)
-                        return -errno;
+                        return errno == ENOTDIR ? false : -errno;
 
                 dir_fd = fd;
         }
diff --git a/src/partition/repart.c b/src/partition/repart.c
index 4cf4e4c1f75..634eb2e50cc 100644
--- a/src/partition/repart.c
+++ b/src/partition/repart.c
@@ -3157,35 +3157,28 @@ static int context_wipe_and_discard(Context *context) {
 
 typedef struct DecryptedPartitionTarget {
         int fd;
+        char *dm_name;
         char *volume;
         struct crypt_device *device;
 } DecryptedPartitionTarget;
 
 static DecryptedPartitionTarget* decrypted_partition_target_free(DecryptedPartitionTarget *t) {
 #ifdef HAVE_LIBCRYPTSETUP
-        _cleanup_free_ char *name = NULL;
         int r;
 
         if (!t)
                 return NULL;
 
-        r = path_extract_filename(t->volume, &name);
-        if (r < 0) {
-                assert(r == -ENOMEM);
-                log_oom();
-        }
-
         safe_close(t->fd);
 
-        if (name) {
-                /* udev or so might access out block device in the background while we are done. Let's hence
-                 * force detach the volume. We sync'ed before, hence this should be safe. */
-                r = sym_crypt_deactivate_by_name(t->device, name, CRYPT_DEACTIVATE_FORCE);
-                if (r < 0)
-                        log_error_errno(r, "Failed to deactivate LUKS device: %m");
-        }
+        /* udev or so might access out block device in the background while we are done. Let's hence
+         * force detach the volume. We sync'ed before, hence this should be safe. */
+        r = sym_crypt_deactivate_by_name(t->device, t->dm_name, CRYPT_DEACTIVATE_FORCE);
+        if (r < 0)
+                log_warning_errno(r, "Failed to deactivate LUKS device, ignoring: %m");
 
         sym_crypt_free(t->device);
+        free(t->dm_name);
         free(t->volume);
         free(t);
 #endif
@@ -3662,6 +3655,7 @@ static int partition_encrypt(Context *context, Partition *p, PartitionTarget *ta
 
                 *t = (DecryptedPartitionTarget) {
                         .fd = TAKE_FD(dev_fd),
+                        .dm_name = TAKE_PTR(dm_name),
                         .volume = TAKE_PTR(vol),
                         .device = TAKE_PTR(cd),
                 };
diff --git a/src/shared/btrfs-util.c b/src/shared/btrfs-util.c
index 429e5afe117..f86645e4eed 100644
--- a/src/shared/btrfs-util.c
+++ b/src/shared/btrfs-util.c
@@ -78,7 +78,7 @@ int btrfs_is_subvol_at(int dir_fd, const char *path) {
 
         /* On btrfs subvolumes always have the inode 256 */
 
-        if (fstatat(dir_fd, strempty(path), &st, (isempty(path) ? AT_EMPTY_PATH : 0)) < 0)
+        if (fstatat(dir_fd, strempty(path), &st, isempty(path) ? AT_EMPTY_PATH : 0) < 0)
                 return -errno;
 
         if (!btrfs_might_be_subvol(&st))
diff --git a/src/shared/rm-rf.c b/src/shared/rm-rf.c
index 3a34281bb95..4664215e906 100644
--- a/src/shared/rm-rf.c
+++ b/src/shared/rm-rf.c
@@ -430,9 +430,7 @@ int rm_rf_at(int dir_fd, const char *path, RemoveFlags flags) {
         int fd, r, q = 0;
 
         assert(dir_fd >= 0 || dir_fd == AT_FDCWD);
-
-        if (FLAGS_SET(flags, REMOVE_ROOT))
-                assert(path && !dot_or_dot_dot(path)); /* unlinkat() does not support AT_EMPTY_PATH or "." so a path must be provided here. */
+        assert(path);
 
         /* For now, don't support dropping subvols when also only dropping directories, since we can't do
          * this race-freely. */