diff --git a/man/bootctl.xml b/man/bootctl.xml
index b1fe6b22f4..edb6bd07e7 100644
--- a/man/bootctl.xml
+++ b/man/bootctl.xml
@@ -504,7 +504,7 @@
 
       <varlistentry>
         <term><option>--all-architectures</option></term>
-        <listitem><para>Install binaries for all supported EFI architectures (this implies <option>--no-variables</option>).</para>
+        <listitem><para>Install binaries for all supported EFI architectures (this implies <option>--variables=no</option>).</para>
 
         <xi:include href="version-info.xml" xpointer="v252"/></listitem>
       </varlistentry>
diff --git a/shell-completion/bash/bootctl b/shell-completion/bash/bootctl
index a06a93e8c2..31aaa1cace 100644
--- a/shell-completion/bash/bootctl
+++ b/shell-completion/bash/bootctl
@@ -32,13 +32,20 @@ _bootctl() {
     local i verb comps
     local cur=${COMP_WORDS[COMP_CWORD]} prev=${COMP_WORDS[COMP_CWORD-1]}
     local -A OPTS=(
-        [STANDALONE]='-h --help -p --print-esp-path -x --print-boot-path --version --no-variables --no-pager --graceful --dry-run'
-        [ARG]='--esp-path --boot-path --make-machine-id-directory --root --image --install-source --random-seed'
+        [STANDALONE]='-h --help --version
+                      -p --print-esp-path -x --print-boot-path --print-loader-path
+                      --print-stub-path -R --print-root-device -RR
+                      --no-pager --graceful -q --quiet --all-architectures
+                      --dry-run'
+        [ARG]='--esp-path --boot-path --root --image --image-policy --install-source
+               --variables --random-seed --make-entry-directory --entry-token --json
+               --efi-boot-option-description --secure-boot-auto-enroll --private-key
+               --private-key-source --certificate --certificate-source'
     )
 
     if __contains_word "$prev" ${OPTS[ARG]}; then
         case $prev in
-            --esp-path|--boot-path)
+            --esp-path|--boot-path|--private-key|--certificate)
                 if [[ -z $cur ]]; then
                     comps=$(compgen -A directory -- "/" )
                 else
@@ -46,9 +53,12 @@ _bootctl() {
                 fi
                 compopt -o filenames
                 ;;
-            --make-machine-id-directory)
+            --make-entry-directory)
                 comps="yes no auto"
                 ;;
+            --entry-token)
+                comps="machine-id os-id os-image-id auto literal:"
+                ;;
             --image|--root)
                 compopt -o nospace
                 comps=$( compgen -A file -- "$cur" )
@@ -56,9 +66,12 @@ _bootctl() {
             --install-source)
                 comps="image host auto"
                 ;;
-            --random-seed)
+            --random-seed|--variables|--secure-boot-auto-enroll)
                 comps="yes no"
                 ;;
+            --json)
+                comps=$( bootctl --json=help 2>/dev/null )
+                ;;
         esac
         COMPREPLY=( $(compgen -W '$comps' -- "$cur") )
         return 0
@@ -71,7 +84,7 @@ _bootctl() {
 
     local -A VERBS=(
         [STANDALONE]='help status install update remove is-installed random-seed list set-timeout set-timeout-oneshot cleanup'
-        [BOOTENTRY]='set-default set-oneshot unlink'
+        [BOOTENTRY]='set-default set-oneshot set-sysfail unlink'
         [BOOLEAN]='reboot-to-firmware'
         [FILE]='kernel-identify kernel-inspect'
     )
diff --git a/src/bootctl/bootctl.c b/src/bootctl/bootctl.c
index 192f9ddb60..5c649ef1e3 100644
--- a/src/bootctl/bootctl.c
+++ b/src/bootctl/bootctl.c
@@ -341,7 +341,7 @@ static int help(int argc, char *argv[], void *userdata) {
                "     --efi-boot-option-description=DESCRIPTION\n"
                "                       Description of the entry in the boot option list\n"
                "     --dry-run         Dry run (unlink and cleanup)\n"
-               "     --secure-boot-auto-enroll\n"
+               "     --secure-boot-auto-enroll=yes|no\n"
                "                       Set up secure boot auto-enrollment\n"
                "     --private-key=PATH|URI\n"
                "                       Private key to use when setting up secure boot\n"
@@ -652,7 +652,7 @@ static int parse_argv(int argc, char *argv[]) {
                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--install-from-host is only supported with --root= or --image=.");
 
         if (arg_dry_run && argv[optind] && !STR_IN_SET(argv[optind], "unlink", "cleanup"))
-                return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--dry is only supported with --unlink or --cleanup");
+                return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--dry-run is only supported with --unlink or --cleanup");
 
         if (arg_secure_boot_auto_enroll && !arg_certificate)
                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Secure boot auto-enrollment requested but no certificate provided");