diff --git a/NEWS b/NEWS
index 7bdd3e0dbd..75712036b0 100644
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,14 @@ CHANGES WITH 258 in spe:
 
         Incompatible changes:
 
+        * Support for cgroup v1 ('legacy' and 'hybrid' hierarchies) has been
+          removed. cgroup v2 ('unified' hierarchy) will always be mounted
+          during system bootup and systemd-nspawn container initialization.
+
+        * The minimum kernel baseline version has been bumped to v5.4
+          (released in 2019), with the recommended version now going up to
+          v5.7. Consult the README file for a list of required kernel APIs.
+
         * The default access mode of tty/pts device nodes has been changed to
           0600, which was 0620 in the older releases, due to general security
           concerns about terminals being written to by other users. To restore
@@ -65,15 +73,6 @@ CHANGES WITH 258 in spe:
           migrated between cgroups. It is likely to be fully removed in a
           future release (reach out if you have use cases).
 
-        * The recommended kernel baseline version has been bumped to v5.4
-          (released in 2019). Expect limited testing on older kernel versions,
-          where "old-kernel" taint flag would also be set. Support for them
-          will be phased out in a future release in 2025, i.e. we expect to bump
-          the minimum baseline to v5.4 then too.
-
-        * The complete removal of support for cgroup v1 ('legacy' and 'hybrid'
-          hierarchies) is scheduled for v258.
-
         * Support for System V service scripts is deprecated and will be
           removed in v258. Please make sure to update your software
           *now* to include a native systemd unit file instead of a legacy
diff --git a/docs/ENVIRONMENT.md b/docs/ENVIRONMENT.md
index 55f6d22b49..c2ea147738 100644
--- a/docs/ENVIRONMENT.md
+++ b/docs/ENVIRONMENT.md
@@ -150,9 +150,6 @@ All tools:
 
 `systemd-nspawn`:
 
-* `$SYSTEMD_NSPAWN_UNIFIED_HIERARCHY=1` — if set, force `systemd-nspawn` into
-  unified cgroup hierarchy mode.
-
 * `$SYSTEMD_NSPAWN_API_VFS_WRITABLE=1` — if set, make `/sys/`, `/proc/sys/`,
   and friends writable in the container. If set to "network", leave only
   `/proc/sys/net/` writable.
diff --git a/meson.build b/meson.build
index 61fba8dc09..6fe36bc65b 100644
--- a/meson.build
+++ b/meson.build
@@ -271,7 +271,6 @@ conf.set_quoted('SYSTEMCTL_BINARY_PATH',                      bindir / 'systemct
 conf.set_quoted('SYSTEMD_BINARY_PATH',                        libexecdir / 'systemd')
 conf.set_quoted('SYSTEMD_EXECUTOR_BINARY_PATH',               libexecdir / 'systemd-executor')
 conf.set_quoted('SYSTEMD_CATALOG_DIR',                        catalogdir)
-conf.set_quoted('SYSTEMD_CGROUPS_AGENT_PATH',                 libexecdir / 'systemd-cgroups-agent')
 conf.set_quoted('SYSTEMD_CRYPTSETUP_PATH',                    bindir / 'systemd-cryptsetup')
 conf.set_quoted('SYSTEMD_EXPORT_PATH',                        libexecdir / 'systemd-export')
 conf.set_quoted('SYSTEMD_FSCK_PATH',                          libexecdir / 'systemd-fsck')
@@ -2305,7 +2304,6 @@ subdir('src/boot')
 subdir('src/bootctl')
 subdir('src/busctl')
 subdir('src/cgls')
-subdir('src/cgroups-agent')
 subdir('src/cgtop')
 subdir('src/coredump')
 subdir('src/creds')
diff --git a/mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf.d/pkgenv.conf b/mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf.d/pkgenv.conf
index 1f8fe976f4..5fb77a871d 100644
--- a/mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf.d/pkgenv.conf
+++ b/mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf.d/pkgenv.conf
@@ -9,5 +9,5 @@ Environment=
         GIT_URL=https://salsa.debian.org/systemd-team/systemd.git
         GIT_SUBDIR=debian
         GIT_BRANCH=debian/master
-        GIT_COMMIT=d8c7f8f7f461b1edc3bf5040509e697ea574c990
+        GIT_COMMIT=46432631232015b78071f84e5a3fb944621c83f7
         PKG_SUBDIR=debian
diff --git a/mkosi/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.build.chroot b/mkosi/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.build.chroot
index 44ef675168..bef5a0de29 100755
--- a/mkosi/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.build.chroot
+++ b/mkosi/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.build.chroot
@@ -18,8 +18,10 @@ TS="${SOURCE_DATE_EPOCH:-$(date +%s)}"
 # The openSUSE filelists hardcode the manpage compression extension. This causes rpmbuild errors since we
 # disable manpage compression as the files cannot be found. Fix the issue by removing the compression
 # extension.
+#
+# TODO: remove manual cgroups-agent patch when the upstream spec is updated
 while read -r filelist; do
-    sed 's/\.gz$//' "$filelist" >"/tmp/$(basename "$filelist")"
+    sed 's/\.gz$//; /systemd-cgroups-agent/d' "$filelist" >"/tmp/$(basename "$filelist")"
     mount --bind "/tmp/$(basename "$filelist")" "$filelist"
 done < <(find "pkg/$PKG_SUBDIR${GIT_SUBDIR:+/$GIT_SUBDIR}" -name "files.*")
 
diff --git a/src/basic/cgroup-util.c b/src/basic/cgroup-util.c
index 0a46fba945..4baadf0c6b 100644
--- a/src/basic/cgroup-util.c
+++ b/src/basic/cgroup-util.c
@@ -1028,10 +1028,6 @@ int cg_get_root_path(char **ret_path) {
                 return r;
 
         e = endswith(p, "/" SPECIAL_INIT_SCOPE);
-        if (!e)
-                e = endswith(p, "/" SPECIAL_SYSTEM_SLICE); /* legacy */
-        if (!e)
-                e = endswith(p, "/system"); /* even more legacy */
         if (e)
                 *e = 0;
 
@@ -2078,59 +2074,6 @@ int cg_mask_supported(CGroupMask *ret) {
         return cg_mask_supported_subtree(root, ret);
 }
 
-int cg_kernel_controllers(Set **ret) {
-        _cleanup_set_free_ Set *controllers = NULL;
-        _cleanup_fclose_ FILE *f = NULL;
-        int r;
-
-        assert(ret);
-
-        /* Determines the full list of kernel-known controllers. Might include controllers we don't actually support
-         * and controllers that aren't currently accessible (because not mounted). This does not include "name="
-         * pseudo-controllers. */
-
-        r = fopen_unlocked("/proc/cgroups", "re", &f);
-        if (r == -ENOENT) {
-                *ret = NULL;
-                return 0;
-        }
-        if (r < 0)
-                return r;
-
-        /* Ignore the header line */
-        (void) read_line(f, SIZE_MAX, NULL);
-
-        for (;;) {
-                _cleanup_free_ char *controller = NULL;
-                int enabled = 0;
-
-                if (fscanf(f, "%ms %*i %*i %i", &controller, &enabled) != 2) {
-
-                        if (ferror(f))
-                                return -errno;
-
-                        if (feof(f))
-                                break;
-
-                        return -EBADMSG;
-                }
-
-                if (!enabled)
-                        continue;
-
-                if (!cg_controller_is_valid(controller))
-                        return -EBADMSG;
-
-                r = set_ensure_consume(&controllers, &string_hash_ops_free, TAKE_PTR(controller));
-                if (r < 0)
-                        return r;
-        }
-
-        *ret = TAKE_PTR(controllers);
-
-        return 0;
-}
-
 /* The hybrid mode was initially implemented in v232 and simply mounted cgroup2 on
  * /sys/fs/cgroup/systemd. This unfortunately broke other tools (such as docker) which expected the v1
  * "name=systemd" hierarchy on /sys/fs/cgroup/systemd. From v233 and on, the hybrid mode mounts v2 on
diff --git a/src/basic/cgroup-util.h b/src/basic/cgroup-util.h
index a6aa9337ad..26a4fb5633 100644
--- a/src/basic/cgroup-util.h
+++ b/src/basic/cgroup-util.h
@@ -311,8 +311,6 @@ int cg_mask_supported_subtree(const char *root, CGroupMask *ret);
 int cg_mask_from_string(const char *s, CGroupMask *ret);
 int cg_mask_to_string(CGroupMask mask, char **ret);
 
-int cg_kernel_controllers(Set **controllers);
-
 bool cg_ns_supported(void);
 bool cg_freezer_supported(void);
 bool cg_kill_supported(void);
diff --git a/src/basic/procfs-util.c b/src/basic/procfs-util.c
index d7cfcd9105..98f390e49a 100644
--- a/src/basic/procfs-util.c
+++ b/src/basic/procfs-util.c
@@ -62,13 +62,13 @@ int procfs_tasks_set_limit(uint64_t limit) {
         /* As pid_max is about the numeric pid_t range we'll bump it if necessary, but only ever increase it, never
          * decrease it, as threads-max is the much more relevant sysctl. */
         if (limit > pid_max-1) {
-                sprintf(buffer, "%" PRIu64, limit+1); /* Add one, since PID 0 is not a valid PID */
+                xsprintf(buffer, "%" PRIu64, limit+1); /* Add one, since PID 0 is not a valid PID */
                 r = write_string_file("/proc/sys/kernel/pid_max", buffer, WRITE_STRING_FILE_DISABLE_BUFFER);
                 if (r < 0)
                         return r;
         }
 
-        sprintf(buffer, "%" PRIu64, limit);
+        xsprintf(buffer, "%" PRIu64, limit);
         r = write_string_file("/proc/sys/kernel/threads-max", buffer, WRITE_STRING_FILE_DISABLE_BUFFER);
         if (r < 0) {
                 uint64_t threads_max;
@@ -175,46 +175,34 @@ int procfs_cpu_get_usage(nsec_t *ret) {
         return 0;
 }
 
-int convert_meminfo_value_to_uint64_bytes(const char *word, uint64_t *ret) {
+int convert_meminfo_value_to_uint64_bytes(const char *s, uint64_t *ret) {
         _cleanup_free_ char *w = NULL;
-        char *digits, *e;
         uint64_t v;
-        size_t n;
         int r;
 
-        assert(word);
+        assert(s);
         assert(ret);
 
-        w = strdup(word);
-        if (!w)
-                return -ENOMEM;
-
-        /* Determine length of numeric value */
-        n = strspn(w, WHITESPACE);
-        digits = w + n;
-        n = strspn(digits, DIGITS);
-        if (n == 0)
-                return -EINVAL;
-        e = digits + n;
-
-        /* Ensure the line ends in " kB" */
-        n = strspn(e, WHITESPACE);
-        if (n == 0)
-                return -EINVAL;
-        if (!streq(e + n, "kB"))
+        r = extract_first_word(&s, &w, /* separators = */ NULL, /* flags = */ 0);
+        if (r < 0)
+                return r;
+        if (r == 0)
                 return -EINVAL;
 
-        *e = 0;
-        r = safe_atou64(digits, &v);
+        /* Ensure the line ends in "kB" */
+        if (!streq(s, "kB"))
+                return -EINVAL;
+
+        r = safe_atou64(w, &v);
         if (r < 0)
                 return r;
         if (v == UINT64_MAX)
                 return -EINVAL;
 
-        if (v > UINT64_MAX/1024)
+        if (!MUL_ASSIGN_SAFE(&v, U64_KB))
                 return -EOVERFLOW;
 
-        *ret = v * 1024U;
+        *ret = v;
         return 0;
 }
 
diff --git a/src/cgroups-agent/cgroups-agent.c b/src/cgroups-agent/cgroups-agent.c
deleted file mode 100644
index 16c5a2a693..0000000000
--- a/src/cgroups-agent/cgroups-agent.c
+++ /dev/null
@@ -1,54 +0,0 @@
-/* SPDX-License-Identifier: LGPL-2.1-or-later */
-
-#include <stdlib.h>
-
-#include "fd-util.h"
-#include "log.h"
-#include "socket-util.h"
-
-int main(int argc, char *argv[]) {
-
-        static const union sockaddr_union sa = {
-                .un.sun_family = AF_UNIX,
-                .un.sun_path = "/run/systemd/cgroups-agent",
-        };
-
-        _cleanup_close_ int fd = -EBADF;
-        ssize_t n;
-        size_t l;
-        int r;
-
-        r = make_null_stdio();
-        if (r < 0) {
-                log_error_errno(r, "Failed to connect stdin/stdout/stderr with /dev/null: %m");
-                return EXIT_FAILURE;
-        }
-
-        if (argc != 2) {
-                log_error("Incorrect number of arguments.");
-                return EXIT_FAILURE;
-        }
-
-        log_setup();
-
-        fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0);
-        if (fd < 0) {
-                log_debug_errno(errno, "Failed to allocate socket: %m");
-                return EXIT_FAILURE;
-        }
-
-        l = strlen(argv[1]);
-
-        n = sendto(fd, argv[1], l, 0, &sa.sa, SOCKADDR_UN_LEN(sa.un));
-        if (n < 0) {
-                log_debug_errno(errno, "Failed to send cgroups agent message: %m");
-                return EXIT_FAILURE;
-        }
-
-        if ((size_t) n != l) {
-                log_debug("Datagram size mismatch");
-                return EXIT_FAILURE;
-        }
-
-        return EXIT_SUCCESS;
-}
diff --git a/src/cgroups-agent/meson.build b/src/cgroups-agent/meson.build
deleted file mode 100644
index 33ff1f55fd..0000000000
--- a/src/cgroups-agent/meson.build
+++ /dev/null
@@ -1,8 +0,0 @@
-# SPDX-License-Identifier: LGPL-2.1-or-later
-
-executables += [
-        libexec_template + {
-                'name' : 'systemd-cgroups-agent',
-                'sources' : files('cgroups-agent.c'),
-        },
-]
diff --git a/src/core/cgroup.c b/src/core/cgroup.c
index 4c2fc755b9..f608c422f4 100644
--- a/src/core/cgroup.c
+++ b/src/core/cgroup.c
@@ -4256,11 +4256,7 @@ static int cg_bpf_mask_supported(CGroupMask *ret) {
 }
 
 int manager_setup_cgroup(Manager *m) {
-        _cleanup_free_ char *path = NULL;
-        const char *scope_path;
-        int r, all_unified;
-        CGroupMask mask;
-        char *e;
+        int r;
 
         assert(m);
 
@@ -4271,17 +4267,7 @@ int manager_setup_cgroup(Manager *m) {
                 return log_error_errno(r, "Cannot determine cgroup we are running in: %m");
 
         /* Chop off the init scope, if we are already located in it */
-        e = endswith(m->cgroup_root, "/" SPECIAL_INIT_SCOPE);
-
-        /* LEGACY: Also chop off the system slice if we are in
-         * it. This is to support live upgrades from older systemd
-         * versions where PID 1 was moved there. Also see
-         * cg_get_root_path(). */
-        if (!e && MANAGER_IS_SYSTEM(m)) {
-                e = endswith(m->cgroup_root, "/" SPECIAL_SYSTEM_SLICE);
-                if (!e)
-                        e = endswith(m->cgroup_root, "/system"); /* even more legacy */
-        }
+        char *e = endswith(m->cgroup_root, "/" SPECIAL_INIT_SCOPE);
         if (e)
                 *e = 0;
 
@@ -4289,29 +4275,11 @@ int manager_setup_cgroup(Manager *m) {
          * easily prepend it everywhere. */
         delete_trailing_chars(m->cgroup_root, "/");
 
-        /* 2. Show data */
-        r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, m->cgroup_root, NULL, &path);
-        if (r < 0)
-                return log_error_errno(r, "Cannot find cgroup mount point: %m");
-
-        r = cg_unified();
-        if (r < 0)
-                return log_error_errno(r, "Couldn't determine if we are running in the unified hierarchy: %m");
-
-        all_unified = cg_all_unified();
-        if (all_unified < 0)
-                return log_error_errno(all_unified, "Couldn't determine whether we are in all unified mode: %m");
-        if (all_unified > 0)
-                log_debug("Unified cgroup hierarchy is located at %s.", path);
-        else {
-                r = cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER);
-                if (r < 0)
-                        return log_error_errno(r, "Failed to determine whether systemd's own controller is in unified mode: %m");
-                if (r > 0)
-                        log_debug("Unified cgroup hierarchy is located at %s. Controllers are on legacy hierarchies.", path);
-                else
-                        log_debug("Using cgroup controller " SYSTEMD_CGROUP_CONTROLLER_LEGACY ". File system hierarchy is at %s.", path);
-        }
+        /* 2. Pin the cgroupfs mount, so that it cannot be unmounted */
+        safe_close(m->pin_cgroupfs_fd);
+        m->pin_cgroupfs_fd = open("/sys/fs/cgroup", O_PATH|O_CLOEXEC|O_DIRECTORY);
+        if (m->pin_cgroupfs_fd < 0)
+                return log_error_errno(errno, "Failed to pin cgroup hierarchy: %m");
 
         /* 3. Allocate cgroup empty defer event source */
         m->cgroup_empty_event_source = sd_event_source_disable_unref(m->cgroup_empty_event_source);
@@ -4332,79 +4300,52 @@ int manager_setup_cgroup(Manager *m) {
 
         (void) sd_event_source_set_description(m->cgroup_empty_event_source, "cgroup-empty");
 
-        /* 4. Install notifier inotify object, or agent */
-        if (cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0) {
+        /* 4. Install cgroup empty event notifier inotify object */
+        m->cgroup_inotify_event_source = sd_event_source_disable_unref(m->cgroup_inotify_event_source);
+        safe_close(m->cgroup_inotify_fd);
 
-                /* In the unified hierarchy we can get cgroup empty notifications via inotify. */
+        m->cgroup_inotify_fd = inotify_init1(IN_NONBLOCK|IN_CLOEXEC);
+        if (m->cgroup_inotify_fd < 0)
+                return log_error_errno(errno, "Failed to create control group inotify object: %m");
 
-                m->cgroup_inotify_event_source = sd_event_source_disable_unref(m->cgroup_inotify_event_source);
-                safe_close(m->cgroup_inotify_fd);
+        r = sd_event_add_io(m->event, &m->cgroup_inotify_event_source, m->cgroup_inotify_fd, EPOLLIN, on_cgroup_inotify_event, m);
+        if (r < 0)
+                return log_error_errno(r, "Failed to watch control group inotify object: %m");
 
-                m->cgroup_inotify_fd = inotify_init1(IN_NONBLOCK|IN_CLOEXEC);
-                if (m->cgroup_inotify_fd < 0)
-                        return log_error_errno(errno, "Failed to create control group inotify object: %m");
+        /* Process cgroup empty notifications early. Note that when this event is dispatched it'll
+         * just add the unit to a cgroup empty queue, hence let's run earlier than that. Also see
+         * handling of cgroup agent notifications, for the classic cgroup hierarchy support. */
+        r = sd_event_source_set_priority(m->cgroup_inotify_event_source, EVENT_PRIORITY_CGROUP_INOTIFY);
+        if (r < 0)
+                return log_error_errno(r, "Failed to set priority of inotify event source: %m");
 
-                r = sd_event_add_io(m->event, &m->cgroup_inotify_event_source, m->cgroup_inotify_fd, EPOLLIN, on_cgroup_inotify_event, m);
-                if (r < 0)
-                        return log_error_errno(r, "Failed to watch control group inotify object: %m");
-
-                /* Process cgroup empty notifications early. Note that when this event is dispatched it'll
-                 * just add the unit to a cgroup empty queue, hence let's run earlier than that. Also see
-                 * handling of cgroup agent notifications, for the classic cgroup hierarchy support. */
-                r = sd_event_source_set_priority(m->cgroup_inotify_event_source, EVENT_PRIORITY_CGROUP_INOTIFY);
-                if (r < 0)
-                        return log_error_errno(r, "Failed to set priority of inotify event source: %m");
-
-                (void) sd_event_source_set_description(m->cgroup_inotify_event_source, "cgroup-inotify");
-
-        } else if (MANAGER_IS_SYSTEM(m) && manager_owns_host_root_cgroup(m) && !MANAGER_IS_TEST_RUN(m)) {
-
-                /* On the legacy hierarchy we only get notifications via cgroup agents. (Which isn't really reliable,
-                 * since it does not generate events when control groups with children run empty. */
-
-                r = cg_install_release_agent(SYSTEMD_CGROUP_CONTROLLER, SYSTEMD_CGROUPS_AGENT_PATH);
-                if (r < 0)
-                        log_warning_errno(r, "Failed to install release agent, ignoring: %m");
-                else if (r > 0)
-                        log_debug("Installed release agent.");
-                else if (r == 0)
-                        log_debug("Release agent already installed.");
-        }
+        (void) sd_event_source_set_description(m->cgroup_inotify_event_source, "cgroup-inotify");
 
         /* 5. Make sure we are in the special "init.scope" unit in the root slice. */
-        scope_path = strjoina(m->cgroup_root, "/" SPECIAL_INIT_SCOPE);
-        r = cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER, scope_path, 0);
+        const char *scope_path = strjoina(m->cgroup_root, "/" SPECIAL_INIT_SCOPE);
+        r = cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER, scope_path, /* pid = */ 0);
         if (r >= 0) {
                 /* Also, move all other userspace processes remaining in the root cgroup into that scope. */
                 r = cg_migrate(SYSTEMD_CGROUP_CONTROLLER, m->cgroup_root, SYSTEMD_CGROUP_CONTROLLER, scope_path, 0);
                 if (r < 0)
                         log_warning_errno(r, "Couldn't move remaining userspace processes, ignoring: %m");
 
-                /* 6. And pin it, so that it cannot be unmounted */
-                safe_close(m->pin_cgroupfs_fd);
-                m->pin_cgroupfs_fd = open(path, O_PATH|O_CLOEXEC|O_DIRECTORY);
-                if (m->pin_cgroupfs_fd < 0)
-                        return log_error_errno(errno, "Failed to open pin file: %m");
-
         } else if (!MANAGER_IS_TEST_RUN(m))
                 return log_error_errno(r, "Failed to create %s control group: %m", scope_path);
 
-        /* 7. Always enable hierarchical support if it exists... */
-        if (!all_unified && !MANAGER_IS_TEST_RUN(m))
-                (void) cg_set_attribute("memory", "/", "memory.use_hierarchy", "1");
-
-        /* 8. Figure out which controllers are supported */
+        /* 6. Figure out which controllers are supported */
         r = cg_mask_supported_subtree(m->cgroup_root, &m->cgroup_supported);
         if (r < 0)
                 return log_error_errno(r, "Failed to determine supported controllers: %m");
 
-        /* 9. Figure out which bpf-based pseudo-controllers are supported */
+        /* 7. Figure out which bpf-based pseudo-controllers are supported */
+        CGroupMask mask;
         r = cg_bpf_mask_supported(&mask);
         if (r < 0)
                 return log_error_errno(r, "Failed to determine supported bpf-based pseudo-controllers: %m");
         m->cgroup_supported |= mask;
 
-        /* 10. Log which controllers are supported */
+        /* 8. Log which controllers are supported */
         for (CGroupController c = 0; c < _CGROUP_CONTROLLER_MAX; c++)
                 log_debug("Controller '%s' supported: %s", cgroup_controller_to_string(c),
                           yes_no(m->cgroup_supported & CGROUP_CONTROLLER_TO_MASK(c)));
@@ -4560,11 +4501,7 @@ int unit_get_memory_available(Unit *u, uint64_t *ret) {
                 if (!unit_context)
                         return -ENODATA;
 
-                CGroupRuntime *crt = unit_get_cgroup_runtime(u);
-                if (!crt || !crt->cgroup_path)
-                        continue;
-
-                (void) unit_get_memory_current(u, &current);
+                (void) unit_get_memory_accounting(u, CGROUP_MEMORY_CURRENT, &current);
                 /* in case of error, previous current propagates as lower bound */
 
                 if (unit_has_name(u, SPECIAL_ROOT_SLICE))
@@ -4582,38 +4519,10 @@ int unit_get_memory_available(Unit *u, uint64_t *ret) {
         return 0;
 }
 
-int unit_get_memory_current(Unit *u, uint64_t *ret) {
-        int r;
-
-        // FIXME: Merge this into unit_get_memory_accounting after support for cgroup v1 is dropped
-
-        assert(u);
-        assert(ret);
-
-        if (!UNIT_CGROUP_BOOL(u, memory_accounting))
-                return -ENODATA;
-
-        CGroupRuntime *crt = unit_get_cgroup_runtime(u);
-        if (!crt || !crt->cgroup_path)
-                return -ENODATA;
-
-        /* The root cgroup doesn't expose this information, let's get it from /proc instead */
-        if (unit_has_host_root_cgroup(u))
-                return procfs_memory_get_used(ret);
-
-        if ((crt->cgroup_realized_mask & CGROUP_MASK_MEMORY) == 0)
-                return -ENODATA;
-
-        r = cg_all_unified();
-        if (r < 0)
-                return r;
-
-        return cg_get_attribute_as_uint64("memory", crt->cgroup_path, r > 0 ? "memory.current" : "memory.usage_in_bytes", ret);
-}
-
 int unit_get_memory_accounting(Unit *u, CGroupMemoryAccountingMetric metric, uint64_t *ret) {
 
         static const char* const attributes_table[_CGROUP_MEMORY_ACCOUNTING_METRIC_MAX] = {
+                [CGROUP_MEMORY_CURRENT]       = "memory.current",
                 [CGROUP_MEMORY_PEAK]          = "memory.peak",
                 [CGROUP_MEMORY_SWAP_CURRENT]  = "memory.swap.current",
                 [CGROUP_MEMORY_SWAP_PEAK]     = "memory.swap.peak",
@@ -4632,8 +4541,13 @@ int unit_get_memory_accounting(Unit *u, CGroupMemoryAccountingMetric metric, uin
                 return -ENODATA;
 
         /* The root cgroup doesn't expose this information. */
-        if (unit_has_host_root_cgroup(u))
+        if (unit_has_host_root_cgroup(u)) {
+                /* System-wide memory usage can be acquired from /proc/ */
+                if (metric == CGROUP_MEMORY_CURRENT)
+                        return procfs_memory_get_used(ret);
+
                 return -ENODATA;
+        }
 
         CGroupRuntime *crt = unit_get_cgroup_runtime(u);
         if (!crt)
@@ -4645,12 +4559,6 @@ int unit_get_memory_accounting(Unit *u, CGroupMemoryAccountingMetric metric, uin
         if (!FLAGS_SET(crt->cgroup_realized_mask, CGROUP_MASK_MEMORY))
                 return -ENODATA;
 
-        r = cg_all_unified();
-        if (r < 0)
-                return r;
-        if (r == 0)
-                return -ENODATA;
-
         r = cg_get_attribute_as_uint64("memory", crt->cgroup_path, attributes_table[metric], &bytes);
         if (r < 0 && r != -ENODATA)
                 return r;
@@ -5745,6 +5653,7 @@ static const char* const cgroup_io_accounting_metric_table[_CGROUP_IO_ACCOUNTING
 DEFINE_STRING_TABLE_LOOKUP(cgroup_io_accounting_metric, CGroupIOAccountingMetric);
 
 static const char* const cgroup_memory_accounting_metric_table[_CGROUP_MEMORY_ACCOUNTING_METRIC_MAX] = {
+        [CGROUP_MEMORY_CURRENT]       = "MemoryCurrent",
         [CGROUP_MEMORY_PEAK]          = "MemoryPeak",
         [CGROUP_MEMORY_SWAP_CURRENT]  = "MemorySwapCurrent",
         [CGROUP_MEMORY_SWAP_PEAK]     = "MemorySwapPeak",
diff --git a/src/core/cgroup.h b/src/core/cgroup.h
index b25cdad7d8..7b3fbc3b15 100644
--- a/src/core/cgroup.h
+++ b/src/core/cgroup.h
@@ -280,6 +280,7 @@ typedef enum CGroupMemoryAccountingMetric {
         _CGROUP_MEMORY_ACCOUNTING_METRIC_CACHED_LAST = CGROUP_MEMORY_SWAP_PEAK,
 
         /* These attributes are transient, so no need for caching. */
+        CGROUP_MEMORY_CURRENT,
         CGROUP_MEMORY_SWAP_CURRENT,
         CGROUP_MEMORY_ZSWAP_CURRENT,
 
@@ -478,7 +479,6 @@ int unit_watch_all_pids(Unit *u);
 int unit_synthesize_cgroup_empty_event(Unit *u);
 
 int unit_get_memory_available(Unit *u, uint64_t *ret);
-int unit_get_memory_current(Unit *u, uint64_t *ret);
 int unit_get_memory_accounting(Unit *u, CGroupMemoryAccountingMetric metric, uint64_t *ret);
 int unit_get_tasks_current(Unit *u, uint64_t *ret);
 int unit_get_cpu_usage(Unit *u, nsec_t *ret);
diff --git a/src/core/dbus-unit.c b/src/core/dbus-unit.c
index 68cfed9444..e9a2a4a4c0 100644
--- a/src/core/dbus-unit.c
+++ b/src/core/dbus-unit.c
@@ -1052,29 +1052,6 @@ static int property_get_slice(
         return sd_bus_message_append(reply, "s", unit_slice_name(u));
 }
 
-static int property_get_current_memory(
-                sd_bus *bus,
-                const char *path,
-                const char *interface,
-                const char *property,
-                sd_bus_message *reply,
-                void *userdata,
-                sd_bus_error *error) {
-
-        uint64_t sz = UINT64_MAX;
-        Unit *u = ASSERT_PTR(userdata);
-        int r;
-
-        assert(bus);
-        assert(reply);
-
-        r = unit_get_memory_current(u, &sz);
-        if (r < 0 && r != -ENODATA)
-                log_unit_warning_errno(u, r, "Failed to get current memory usage from cgroup: %m");
-
-        return sd_bus_message_append(reply, "t", sz);
-}
-
 static int property_get_available_memory(
                 sd_bus *bus,
                 const char *path,
@@ -1652,7 +1629,7 @@ const sd_bus_vtable bus_unit_cgroup_vtable[] = {
         SD_BUS_PROPERTY("Slice", "s", property_get_slice, 0, 0),
         SD_BUS_PROPERTY("ControlGroup", "s", property_get_cgroup, 0, 0),
         SD_BUS_PROPERTY("ControlGroupId", "t", property_get_cgroup_id, 0, 0),
-        SD_BUS_PROPERTY("MemoryCurrent", "t", property_get_current_memory, 0, 0),
+        SD_BUS_PROPERTY("MemoryCurrent", "t", property_get_memory_accounting, 0, 0),
         SD_BUS_PROPERTY("MemoryPeak", "t", property_get_memory_accounting, 0, 0),
         SD_BUS_PROPERTY("MemorySwapCurrent", "t", property_get_memory_accounting, 0, 0),
         SD_BUS_PROPERTY("MemorySwapPeak", "t", property_get_memory_accounting, 0, 0),
diff --git a/src/core/dbus.c b/src/core/dbus.c
index 240b74ec41..faec7eb33c 100644
--- a/src/core/dbus.c
+++ b/src/core/dbus.c
@@ -69,61 +69,6 @@ void bus_send_pending_reload_message(Manager *m) {
         return;
 }
 
-int bus_forward_agent_released(Manager *m, const char *path) {
-        int r;
-
-        assert(m);
-        assert(path);
-
-        if (!MANAGER_IS_SYSTEM(m))
-                return 0;
-
-        if (!m->system_bus)
-                return 0;
-
-        /* If we are running a system instance we forward the agent message on the system bus, so that the user
-         * instances get notified about this, too */
-
-        r = sd_bus_emit_signal(m->system_bus,
-                               "/org/freedesktop/systemd1/agent",
-                               "org.freedesktop.systemd1.Agent",
-                               "Released",
-                               "s", path);
-        if (r < 0)
-                return log_debug_errno(r, "Failed to propagate agent release message: %m");
-
-        return 1;
-}
-
-static int signal_agent_released(sd_bus_message *message, void *userdata, sd_bus_error *error) {
-        _cleanup_(sd_bus_creds_unrefp) sd_bus_creds *creds = NULL;
-        Manager *m = ASSERT_PTR(userdata);
-        const char *cgroup;
-        uid_t sender_uid;
-        int r;
-
-        assert(message);
-
-        /* only accept org.freedesktop.systemd1.Agent from UID=0 */
-        r = sd_bus_query_sender_creds(message, SD_BUS_CREDS_EUID, &creds);
-        if (r < 0)
-                return r;
-
-        r = sd_bus_creds_get_euid(creds, &sender_uid);
-        if (r < 0 || sender_uid != 0)
-                return 0;
-
-        /* parse 'cgroup-empty' notification */
-        r = sd_bus_message_read(message, "s", &cgroup);
-        if (r < 0) {
-                bus_log_parse_error(r);
-                return 0;
-        }
-
-        manager_notify_cgroup_empty(m, cgroup);
-        return 0;
-}
-
 static int signal_disconnected(sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Manager *m = ASSERT_PTR(userdata);
         sd_bus *bus;
@@ -890,30 +835,6 @@ int bus_init_api(Manager *m) {
         return 0;
 }
 
-static void bus_setup_system(Manager *m, sd_bus *bus) {
-        int r;
-
-        assert(m);
-        assert(bus);
-
-        /* if we are a user instance we get the Released message via the system bus */
-        if (MANAGER_IS_USER(m)) {
-                r = sd_bus_match_signal_async(
-                                bus,
-                                NULL,
-                                NULL,
-                                "/org/freedesktop/systemd1/agent",
-                                "org.freedesktop.systemd1.Agent",
-                                "Released",
-                                signal_agent_released, NULL, m);
-                if (r < 0)
-                        log_warning_errno(r, "Failed to request Released match on system bus: %m");
-        }
-
-        log_debug("Successfully connected to system bus.");
-        return;
-}
-
 int bus_init_system(Manager *m) {
         _cleanup_(sd_bus_close_unrefp) sd_bus *bus = NULL;
         int r;
@@ -938,10 +859,10 @@ int bus_init_system(Manager *m) {
                         return r;
         }
 
-        bus_setup_system(m, bus);
-
         m->system_bus = TAKE_PTR(bus);
 
+        log_debug("Successfully connected to system bus.");
+
         return 0;
 }
 
diff --git a/src/core/dbus.h b/src/core/dbus.h
index 0f81102fc1..bfd4c8ea4e 100644
--- a/src/core/dbus.h
+++ b/src/core/dbus.h
@@ -22,8 +22,6 @@ void bus_track_serialize(sd_bus_track *t, FILE *f, const char *prefix);
 
 int bus_foreach_bus(Manager *m, sd_bus_track *subscribed2, int (*send_message)(sd_bus *bus, void *userdata), void *userdata);
 
-int bus_forward_agent_released(Manager *m, const char *path);
-
 uint64_t manager_bus_n_queued_write(Manager *m);
 
 void dump_bus_properties(FILE *f);
diff --git a/src/core/main.c b/src/core/main.c
index 0b5efe98b0..3e7894ee5e 100644
--- a/src/core/main.c
+++ b/src/core/main.c
@@ -1723,11 +1723,6 @@ static int become_shutdown(int objective, int retval) {
         if (arg_watchdog_device)
                 (void) strv_extendf(&env_block, "WATCHDOG_DEVICE=%s", arg_watchdog_device);
 
-        /* Avoid the creation of new processes forked by the kernel; at this
-         * point, we will not listen to the signals anyway */
-        if (detect_container() <= 0)
-                (void) cg_uninstall_release_agent(SYSTEMD_CGROUP_CONTROLLER);
-
         (void) write_boot_or_shutdown_osc("shutdown");
 
         execve(SYSTEMD_SHUTDOWN_BINARY_PATH, (char **) command_line, env_block);
diff --git a/src/core/manager-serialize.c b/src/core/manager-serialize.c
index 05021654fa..c5cb82e8d5 100644
--- a/src/core/manager-serialize.c
+++ b/src/core/manager-serialize.c
@@ -137,12 +137,6 @@ int manager_serialize(
                 (void) serialize_item(f, "notify-socket", m->notify_socket);
         }
 
-        if (m->cgroups_agent_fd >= 0) {
-                r = serialize_fd(f, fds, "cgroups-agent-fd", m->cgroups_agent_fd);
-                if (r < 0)
-                        return r;
-        }
-
         if (m->user_lookup_fds[0] >= 0) {
                 r = serialize_fd_many(f, fds, "user-lookup", m->user_lookup_fds, 2);
                 if (r < 0)
@@ -453,15 +447,6 @@ int manager_deserialize(Manager *m, FILE *f, FDSet *fds) {
                         if (r < 0)
                                 return r;
 
-                } else if ((val = startswith(l, "cgroups-agent-fd="))) {
-                        int fd;
-
-                        fd = deserialize_fd(fds, val);
-                        if (fd >= 0) {
-                                m->cgroups_agent_event_source = sd_event_source_disable_unref(m->cgroups_agent_event_source);
-                                close_and_replace(m->cgroups_agent_fd, fd);
-                        }
-
                 } else if ((val = startswith(l, "user-lookup="))) {
 
                         m->user_lookup_event_source = sd_event_source_disable_unref(m->user_lookup_event_source);
@@ -550,7 +535,7 @@ int manager_deserialize(Manager *m, FILE *f, FDSet *fds) {
 
                         if (q < _MANAGER_TIMESTAMP_MAX) /* found it */
                                 (void) deserialize_dual_timestamp(val, m->timestamps + q);
-                        else if (!STARTSWITH_SET(l, "kdbus-fd=", "honor-device-enumeration=", "ready-sent=")) /* ignore deprecated values */
+                        else if (!STARTSWITH_SET(l, "kdbus-fd=", "honor-device-enumeration=", "ready-sent=", "cgroups-agent-fd=")) /* ignore deprecated values */
                                 log_notice("Unknown serialization item '%s', ignoring.", l);
                 }
         }
diff --git a/src/core/manager.c b/src/core/manager.c
index 66840407b5..c2cf191c4d 100644
--- a/src/core/manager.c
+++ b/src/core/manager.c
@@ -122,7 +122,6 @@
 #define DEFAULT_TASKS_MAX ((CGroupTasksMax) { 15U, 100U }) /* 15% */
 
 static int manager_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata);
-static int manager_dispatch_cgroups_agent_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata);
 static int manager_dispatch_signal_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata);
 static int manager_dispatch_time_change_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata);
 static int manager_dispatch_idle_pipe_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata);
@@ -912,7 +911,6 @@ int manager_new(RuntimeScope runtime_scope, ManagerTestRunFlags test_run_flags,
                 .show_status_overridden = _SHOW_STATUS_INVALID,
 
                 .notify_fd = -EBADF,
-                .cgroups_agent_fd = -EBADF,
                 .signal_fd = -EBADF,
                 .user_lookup_fds = EBADF_PAIR,
                 .handoff_timestamp_fds = EBADF_PAIR,
@@ -1131,80 +1129,6 @@ static int manager_setup_notify(Manager *m) {
         return 0;
 }
 
-static int manager_setup_cgroups_agent(Manager *m) {
-
-        static const union sockaddr_union sa = {
-                .un.sun_family = AF_UNIX,
-                .un.sun_path = "/run/systemd/cgroups-agent",
-        };
-        int r;
-
-        /* This creates a listening socket we receive cgroups agent messages on. We do not use D-Bus for delivering
-         * these messages from the cgroups agent binary to PID 1, as the cgroups agent binary is very short-living, and
-         * each instance of it needs a new D-Bus connection. Since D-Bus connections are SOCK_STREAM/AF_UNIX, on
-         * overloaded systems the backlog of the D-Bus socket becomes relevant, as not more than the configured number
-         * of D-Bus connections may be queued until the kernel will start dropping further incoming connections,
-         * possibly resulting in lost cgroups agent messages. To avoid this, we'll use a private SOCK_DGRAM/AF_UNIX
-         * socket, where no backlog is relevant as communication may take place without an actual connect() cycle, and
-         * we thus won't lose messages.
-         *
-         * Note that PID 1 will forward the agent message to system bus, so that the user systemd instance may listen
-         * to it. The system instance hence listens on this special socket, but the user instances listen on the system
-         * bus for these messages. */
-
-        if (MANAGER_IS_TEST_RUN(m))
-                return 0;
-
-        if (!MANAGER_IS_SYSTEM(m))
-                return 0;
-
-        r = cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER);
-        if (r < 0)
-                return log_error_errno(r, "Failed to determine whether unified cgroups hierarchy is used: %m");
-        if (r > 0) /* We don't need this anymore on the unified hierarchy */
-                return 0;
-
-        if (m->cgroups_agent_fd < 0) {
-                _cleanup_close_ int fd = -EBADF;
-
-                /* First free all secondary fields */
-                m->cgroups_agent_event_source = sd_event_source_disable_unref(m->cgroups_agent_event_source);
-
-                fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
-                if (fd < 0)
-                        return log_error_errno(errno, "Failed to allocate cgroups agent socket: %m");
-
-                (void) fd_increase_rxbuf(fd, MANAGER_SOCKET_RCVBUF_SIZE);
-
-                (void) sockaddr_un_unlink(&sa.un);
-
-                /* Only allow root to connect to this socket */
-                WITH_UMASK(0077)
-                        r = bind(fd, &sa.sa, SOCKADDR_UN_LEN(sa.un));
-                if (r < 0)
-                        return log_error_errno(errno, "bind(%s) failed: %m", sa.un.sun_path);
-
-                m->cgroups_agent_fd = TAKE_FD(fd);
-        }
-
-        if (!m->cgroups_agent_event_source) {
-                r = sd_event_add_io(m->event, &m->cgroups_agent_event_source, m->cgroups_agent_fd, EPOLLIN, manager_dispatch_cgroups_agent_fd, m);
-                if (r < 0)
-                        return log_error_errno(r, "Failed to allocate cgroups agent event source: %m");
-
-                /* Process cgroups notifications early. Note that when the agent notification is received
-                 * we'll just enqueue the unit in the cgroup empty queue, hence pick a high priority than
-                 * that. Also see handling of cgroup inotify for the unified cgroup stuff. */
-                r = sd_event_source_set_priority(m->cgroups_agent_event_source, EVENT_PRIORITY_CGROUP_AGENT);
-                if (r < 0)
-                        return log_error_errno(r, "Failed to set priority of cgroups agent event source: %m");
-
-                (void) sd_event_source_set_description(m->cgroups_agent_event_source, "manager-cgroups-agent");
-        }
-
-        return 0;
-}
-
 static int manager_setup_user_lookup_fd(Manager *m) {
         int r;
 
@@ -1758,7 +1682,6 @@ Manager* manager_free(Manager *m) {
         sd_event_source_unref(m->signal_event_source);
         sd_event_source_unref(m->sigchld_event_source);
         sd_event_source_unref(m->notify_event_source);
-        sd_event_source_unref(m->cgroups_agent_event_source);
         sd_event_source_unref(m->time_change_event_source);
         sd_event_source_unref(m->timezone_change_event_source);
         sd_event_source_unref(m->jobs_in_progress_event_source);
@@ -1770,7 +1693,6 @@ Manager* manager_free(Manager *m) {
 
         safe_close(m->signal_fd);
         safe_close(m->notify_fd);
-        safe_close(m->cgroups_agent_fd);
         safe_close_pair(m->user_lookup_fds);
         safe_close_pair(m->handoff_timestamp_fds);
         safe_close_pair(m->pidref_transport_fds);
@@ -2133,11 +2055,6 @@ int manager_startup(Manager *m, FILE *serialization, FDSet *fds, const char *roo
                         /* No sense to continue without notifications, our children would fail anyway. */
                         return r;
 
-                r = manager_setup_cgroups_agent(m);
-                if (r < 0)
-                        /* Likewise, no sense to continue without empty cgroup notifications. */
-                        return r;
-
                 r = manager_setup_user_lookup_fd(m);
                 if (r < 0)
                         /* This shouldn't fail, except if things are really broken. */
@@ -2677,35 +2594,6 @@ static unsigned manager_dispatch_dbus_queue(Manager *m) {
         return n;
 }
 
-static int manager_dispatch_cgroups_agent_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata) {
-        Manager *m = userdata;
-        char buf[PATH_MAX];
-        ssize_t n;
-
-        n = recv(fd, buf, sizeof(buf), 0);
-        if (n < 0)
-                return log_error_errno(errno, "Failed to read cgroups agent message: %m");
-        if (n == 0) {
-                log_error("Got zero-length cgroups agent message, ignoring.");
-                return 0;
-        }
-        if ((size_t) n >= sizeof(buf)) {
-                log_error("Got overly long cgroups agent message, ignoring.");
-                return 0;
-        }
-
-        if (memchr(buf, 0, n)) {
-                log_error("Got cgroups agent message with embedded NUL byte, ignoring.");
-                return 0;
-        }
-        buf[n] = 0;
-
-        manager_notify_cgroup_empty(m, buf);
-        (void) bus_forward_agent_released(m, buf);
-
-        return 0;
-}
-
 static bool manager_process_barrier_fd(char * const *tags, FDSet *fds) {
 
         /* nothing else must be sent when using BARRIER=1 */
@@ -3709,7 +3597,6 @@ int manager_reload(Manager *m) {
 
         /* Re-register notify_fd as event source, and set up other sockets/communication channels we might need */
         (void) manager_setup_notify(m);
-        (void) manager_setup_cgroups_agent(m);
         (void) manager_setup_user_lookup_fd(m);
         (void) manager_setup_handoff_timestamp_fd(m);
         (void) manager_setup_pidref_transport_fd(m);
diff --git a/src/core/manager.h b/src/core/manager.h
index e42ee3dd36..aab8573c18 100644
--- a/src/core/manager.h
+++ b/src/core/manager.h
@@ -269,9 +269,6 @@ struct Manager {
         int notify_fd;
         sd_event_source *notify_event_source;
 
-        int cgroups_agent_fd;
-        sd_event_source *cgroups_agent_event_source;
-
         int signal_fd;
         sd_event_source *signal_event_source;
 
@@ -685,8 +682,7 @@ enum {
         EVENT_PRIORITY_USER_LOOKUP       = SD_EVENT_PRIORITY_NORMAL-12,
         EVENT_PRIORITY_MOUNT_TABLE       = SD_EVENT_PRIORITY_NORMAL-11,
         EVENT_PRIORITY_SWAP_TABLE        = SD_EVENT_PRIORITY_NORMAL-11,
-        EVENT_PRIORITY_CGROUP_AGENT      = SD_EVENT_PRIORITY_NORMAL-10, /* cgroupv1 */
-        EVENT_PRIORITY_CGROUP_INOTIFY    = SD_EVENT_PRIORITY_NORMAL-10, /* cgroupv2 */
+        EVENT_PRIORITY_CGROUP_INOTIFY    = SD_EVENT_PRIORITY_NORMAL-10,
         EVENT_PRIORITY_CGROUP_OOM        = SD_EVENT_PRIORITY_NORMAL-9,
         EVENT_PRIORITY_PIDREF            = SD_EVENT_PRIORITY_NORMAL-8,
         EVENT_PRIORITY_HANDOFF_TIMESTAMP = SD_EVENT_PRIORITY_NORMAL-7,
diff --git a/src/nspawn/meson.build b/src/nspawn/meson.build
index b995e69cb3..d0c919e1e3 100644
--- a/src/nspawn/meson.build
+++ b/src/nspawn/meson.build
@@ -16,7 +16,6 @@ libnspawn_core_sources = files(
         'nspawn-settings.c',
         'nspawn-setuid.c',
         'nspawn-stub-pid1.c',
-        'nspawn-util.c',
 )
 
 nspawn_gperf_c = custom_target(
@@ -62,18 +61,11 @@ executables += [
         },
         nspawn_test_template + {
                 'sources' : files('test-nspawn-tables.c'),
-                'conditions' : ['ENABLE_NSPAWN'],
-        },
-        nspawn_test_template + {
-                'sources' : files('test-nspawn-util.c'),
-                'conditions' : ['ENABLE_NSPAWN'],
         },
         nspawn_fuzz_template + {
                 'sources' : files('fuzz-nspawn-settings.c'),
-                'conditions' : ['ENABLE_NSPAWN'],
         },
         nspawn_fuzz_template + {
                 'sources' : files('fuzz-nspawn-oci.c'),
-                'conditions' : ['ENABLE_NSPAWN'],
         },
 ]
diff --git a/src/nspawn/nspawn-cgroup.c b/src/nspawn/nspawn-cgroup.c
index 4ee21c0779..09a581a42a 100644
--- a/src/nspawn/nspawn-cgroup.c
+++ b/src/nspawn/nspawn-cgroup.c
@@ -5,32 +5,28 @@
 #include "alloc-util.h"
 #include "cgroup-setup.h"
 #include "fd-util.h"
-#include "fileio.h"
 #include "format-util.h"
 #include "fs-util.h"
 #include "mkdir.h"
+#include "mount-setup.h"
 #include "mount-util.h"
 #include "mountpoint-util.h"
 #include "nspawn-cgroup.h"
-#include "nspawn-mount.h"
 #include "nsresource.h"
 #include "path-util.h"
-#include "rm-rf.h"
 #include "string-util.h"
-#include "strv.h"
-#include "tmpfile-util.h"
-#include "user-util.h"
 
 static int chown_cgroup_path(const char *path, uid_t uid_shift) {
         _cleanup_close_ int fd = -EBADF;
 
-        fd = open(path, O_RDONLY|O_CLOEXEC|O_DIRECTORY);
+        assert(path);
+
+        fd = open(path, O_PATH|O_CLOEXEC|O_DIRECTORY);
         if (fd < 0)
                 return -errno;
 
         FOREACH_STRING(fn,
                        ".",
-                       "cgroup.clone_children",
                        "cgroup.controllers",
                        "cgroup.events",
                        "cgroup.procs",
@@ -38,95 +34,27 @@ static int chown_cgroup_path(const char *path, uid_t uid_shift) {
                        "cgroup.subtree_control",
                        "cgroup.threads",
                        "memory.oom.group",
-                       "memory.reclaim",
-                       "notify_on_release",
-                       "tasks")
+                       "memory.reclaim")
                 if (fchownat(fd, fn, uid_shift, uid_shift, 0) < 0)
-                        log_full_errno(errno == ENOENT ? LOG_DEBUG :  LOG_WARNING, errno,
+                        log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno,
                                        "Failed to chown \"%s/%s\", ignoring: %m", path, fn);
 
         return 0;
 }
 
-int sync_cgroup(pid_t pid, CGroupUnified unified_requested, uid_t uid_shift) {
-        _cleanup_(rmdir_and_freep) char *tree = NULL;
-        _cleanup_free_ char *cgroup = NULL;
-        char pid_string[DECIMAL_STR_MAX(pid) + 1];
-        bool undo_mount = false;
-        const char *fn;
-        int r, unified_controller;
-
-        unified_controller = cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER);
-        if (unified_controller < 0)
-                return log_error_errno(unified_controller, "Failed to determine whether the systemd hierarchy is unified: %m");
-        if ((unified_controller > 0) == (unified_requested >= CGROUP_UNIFIED_SYSTEMD))
-                return 0;
-
-        /* When the host uses the legacy cgroup setup, but the
-         * container shall use the unified hierarchy, let's make sure
-         * we copy the path from the name=systemd hierarchy into the
-         * unified hierarchy. Similar for the reverse situation. */
-
-        r = cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER, pid, &cgroup);
-        if (r < 0)
-                return log_error_errno(r, "Failed to get control group of " PID_FMT ": %m", pid);
-
-        /* In order to access the unified hierarchy we need to mount it */
-        r = mkdtemp_malloc("/tmp/unifiedXXXXXX", &tree);
-        if (r < 0)
-                return log_error_errno(r, "Failed to generate temporary mount point for unified hierarchy: %m");
-
-        if (unified_controller > 0)
-                r = mount_nofollow_verbose(LOG_ERR, "cgroup", tree, "cgroup",
-                                           MS_NOSUID|MS_NOEXEC|MS_NODEV, "none,name=systemd,xattr");
-        else
-                r = mount_nofollow_verbose(LOG_ERR, "cgroup", tree, "cgroup2",
-                                           MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL);
-        if (r < 0)
-                goto finish;
-
-        undo_mount = true;
-
-        /* If nspawn dies abruptly the cgroup hierarchy created below
-         * its unit isn't cleaned up. So, let's remove it
-         * https://github.com/systemd/systemd/pull/4223#issuecomment-252519810 */
-        fn = strjoina(tree, cgroup);
-        (void) rm_rf(fn, REMOVE_ROOT|REMOVE_ONLY_DIRECTORIES);
-
-        fn = strjoina(tree, cgroup, "/cgroup.procs");
-
-        sprintf(pid_string, PID_FMT, pid);
-        r = write_string_file(fn, pid_string, WRITE_STRING_FILE_DISABLE_BUFFER|WRITE_STRING_FILE_MKDIR_0755);
-        if (r < 0) {
-                log_error_errno(r, "Failed to move process: %m");
-                goto finish;
-        }
-
-        fn = strjoina(tree, cgroup);
-        r = chown_cgroup_path(fn, uid_shift);
-        if (r < 0)
-                log_error_errno(r, "Failed to chown() cgroup %s: %m", fn);
-finish:
-        if (undo_mount)
-                (void) umount_verbose(LOG_ERR, tree, UMOUNT_NOFOLLOW);
-
-        return r;
-}
-
 int create_subcgroup(
                 pid_t pid,
                 bool keep_unit,
-                CGroupUnified unified_requested,
                 uid_t uid_shift,
                 int userns_fd,
                 UserNamespaceMode userns_mode) {
 
         _cleanup_free_ char *cgroup = NULL, *payload = NULL;
         CGroupMask supported;
-        char *e;
         int r;
 
         assert(pid > 1);
+        assert((userns_fd >= 0) == (userns_mode == USER_NAMESPACE_MANAGED));
 
         /* In the unified hierarchy inner nodes may only contain subgroups, but not processes. Hence, if we running in
          * the unified hierarchy and the container does the same, and we did not create a scope unit for the container
@@ -136,12 +64,7 @@ int create_subcgroup(
          * its attributes), while the host systemd will only delegate cgroups for children of the cgroup created for a
          * delegation unit, instead of the cgroup itself. This means, if we'd pass on the cgroup allocated from the
          * host systemd directly to the payload, the host and payload systemd might fight for the cgroup
-         * attributes. Hence, let's insert an intermediary cgroup to cover that case too.
-         *
-         * Note that we only bother with the main hierarchy here, not with any secondary ones. On the unified setup
-         * that's fine because there's only one hierarchy anyway and controllers are enabled directly on it. On the
-         * legacy setup, this is fine too, since delegation of controllers is generally not safe there, hence we won't
-         * do it. */
+         * attributes. Hence, let's insert an intermediary cgroup to cover that case too. */
 
         r = cg_mask_supported(&supported);
         if (r < 0)
@@ -155,7 +78,7 @@ int create_subcgroup(
                 return log_error_errno(r, "Failed to get our control group: %m");
 
         /* If the service manager already placed us in the supervisor cgroup, let's handle that. */
-        e = endswith(cgroup, "/supervisor");
+        char *e = endswith(cgroup, "/supervisor");
         if (e)
                 *e = 0; /* chop off, we want the main path delegated to us */
 
@@ -170,17 +93,7 @@ int create_subcgroup(
         if (r < 0)
                 return log_error_errno(r, "Failed to create %s subcgroup: %m", payload);
 
-        if (userns_mode != USER_NAMESPACE_MANAGED) {
-                _cleanup_free_ char *fs = NULL;
-                r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, payload, NULL, &fs);
-                if (r < 0)
-                        return log_error_errno(r, "Failed to get file system path for container cgroup: %m");
-
-                r = chown_cgroup_path(fs, uid_shift);
-                if (r < 0)
-                        return log_error_errno(r, "Failed to chown() cgroup %s: %m", fs);
-
-        } else if (userns_fd >= 0) {
+        if (userns_mode == USER_NAMESPACE_MANAGED) {
                 _cleanup_close_ int cgroup_fd = -EBADF;
 
                 cgroup_fd = cg_path_open(SYSTEMD_CGROUP_CONTROLLER, payload);
@@ -194,19 +107,15 @@ int create_subcgroup(
                 r = nsresource_add_cgroup(userns_fd, cgroup_fd);
                 if (r < 0)
                         return log_error_errno(r, "Failed to add cgroup %s to userns: %m", payload);
-        }
-
-        if (unified_requested == CGROUP_UNIFIED_SYSTEMD || (unified_requested == CGROUP_UNIFIED_NONE && cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0)) {
-                _cleanup_free_ char *lfs = NULL;
-                /* Always propagate access rights from unified to legacy controller */
-
-                r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER_LEGACY, payload, NULL, &lfs);
+        } else {
+                _cleanup_free_ char *fs = NULL;
+                r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, payload, NULL, &fs);
                 if (r < 0)
                         return log_error_errno(r, "Failed to get file system path for container cgroup: %m");
 
-                r = chown_cgroup_path(lfs, uid_shift);
+                r = chown_cgroup_path(fs, uid_shift);
                 if (r < 0)
-                        return log_error_errno(r, "Failed to chown() cgroup %s: %m", lfs);
+                        return log_error_errno(r, "Failed to chown() cgroup %s: %m", fs);
         }
 
         if (keep_unit) {
@@ -225,325 +134,10 @@ int create_subcgroup(
         return 0;
 }
 
-/* Retrieve existing subsystems. This function is called in a new cgroup
- * namespace.
- */
-static int get_process_controllers(Set **ret) {
-        _cleanup_set_free_ Set *controllers = NULL;
-        _cleanup_fclose_ FILE *f = NULL;
-        int r;
-
-        assert(ret);
-
-        f = fopen("/proc/self/cgroup", "re");
-        if (!f)
-                return errno == ENOENT ? -ESRCH : -errno;
-
-        for (;;) {
-                _cleanup_free_ char *line = NULL;
-                char *e, *l;
-
-                r = read_line(f, LONG_LINE_MAX, &line);
-                if (r < 0)
-                        return r;
-                if (r == 0)
-                        break;
-
-                l = strchr(line, ':');
-                if (!l)
-                        continue;
-
-                l++;
-                e = strchr(l, ':');
-                if (!e)
-                        continue;
-
-                *e = 0;
-
-                if (STR_IN_SET(l, "", "name=systemd", "name=unified"))
-                        continue;
-
-                r = set_put_strdup(&controllers, l);
-                if (r < 0)
-                        return r;
-        }
-
-        *ret = TAKE_PTR(controllers);
-
-        return 0;
-}
-
-static int mount_legacy_cgroup_hierarchy(
-                const char *dest,
-                const char *controller,
-                const char *hierarchy,
-                bool read_only) {
-
-        const char *to, *fstype, *opts;
-        int r;
-
-        to = strjoina(strempty(dest), "/sys/fs/cgroup/", hierarchy);
-
-        r = path_is_mount_point_full(to, dest, /* flags = */ 0);
-        if (r < 0 && r != -ENOENT)
-                return log_error_errno(r, "Failed to determine if %s is mounted already: %m", to);
-        if (r > 0)
-                return 0;
-
-        (void) mkdir_p(to, 0755);
-
-        /* The superblock mount options of the mount point need to be
-         * identical to the hosts', and hence writable... */
-        if (streq(controller, SYSTEMD_CGROUP_CONTROLLER_HYBRID)) {
-                fstype = "cgroup2";
-                opts = NULL;
-        } else if (streq(controller, SYSTEMD_CGROUP_CONTROLLER_LEGACY)) {
-                fstype = "cgroup";
-                opts = "none,name=systemd,xattr";
-        } else {
-                fstype = "cgroup";
-                opts = controller;
-        }
-
-        r = mount_nofollow_verbose(LOG_ERR, "cgroup", to, fstype, MS_NOSUID|MS_NOEXEC|MS_NODEV, opts);
-        if (r < 0)
-                return r;
-
-        /* ... hence let's only make the bind mount read-only, not the superblock. */
-        if (read_only) {
-                r = mount_nofollow_verbose(LOG_ERR, NULL, to, NULL,
-                                           MS_BIND|MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, NULL);
-                if (r < 0)
-                        return r;
-        }
-
-        return 1;
-}
-
-/* Mount a legacy cgroup hierarchy when cgroup namespaces are supported. */
-static int mount_legacy_cgns_supported(
-                const char *dest,
-                CGroupUnified unified_requested,
-                bool userns,
-                uid_t uid_shift,
-                uid_t uid_range,
-                const char *selinux_apifs_context) {
-
-        _cleanup_set_free_ Set *controllers = NULL;
-        const char *cgroup_root = "/sys/fs/cgroup", *c;
-        int r;
-
-        (void) mkdir_p(cgroup_root, 0755);
-
-        /* Mount a tmpfs to /sys/fs/cgroup if it's not mounted there yet. */
-        r = path_is_mount_point_full(cgroup_root, dest, AT_SYMLINK_FOLLOW);
-        if (r < 0)
-                return log_error_errno(r, "Failed to determine if /sys/fs/cgroup is already mounted: %m");
-        if (r == 0) {
-                _cleanup_free_ char *options = NULL;
-
-                /* When cgroup namespaces are enabled and user namespaces are
-                 * used then the mount of the cgroupfs is done *inside* the new
-                 * user namespace. We're root in the new user namespace and the
-                 * kernel will happily translate our uid/gid to the correct
-                 * uid/gid as seen from e.g. /proc/1/mountinfo. So we simply
-                 * pass uid 0 and not uid_shift to tmpfs_patch_options().
-                 */
-                r = tmpfs_patch_options("mode=0755" TMPFS_LIMITS_SYS_FS_CGROUP, 0, selinux_apifs_context, &options);
-                if (r < 0)
-                        return log_oom();
-
-                r = mount_nofollow_verbose(LOG_ERR, "tmpfs", cgroup_root, "tmpfs",
-                                           MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME, options);
-                if (r < 0)
-                        return r;
-        }
-
-        r = cg_all_unified();
-        if (r < 0)
-                return r;
-        if (r > 0)
-                goto skip_controllers;
-
-        r = get_process_controllers(&controllers);
-        if (r < 0)
-                return log_error_errno(r, "Failed to determine cgroup controllers: %m");
-
-        for (;;) {
-                _cleanup_free_ const char *controller = NULL;
-
-                controller = set_steal_first(controllers);
-                if (!controller)
-                        break;
-
-                r = mount_legacy_cgroup_hierarchy("", controller, controller, !userns);
-                if (r < 0)
-                        return r;
-
-                /* When multiple hierarchies are co-mounted, make their
-                 * constituting individual hierarchies a symlink to the
-                 * co-mount.
-                 */
-                c = controller;
-                for (;;) {
-                        _cleanup_free_ char *target = NULL, *tok = NULL;
-
-                        r = extract_first_word(&c, &tok, ",", 0);
-                        if (r < 0)
-                                return log_error_errno(r, "Failed to extract co-mounted cgroup controller: %m");
-                        if (r == 0)
-                                break;
-
-                        if (streq(controller, tok))
-                                break;
-
-                        target = path_join("/sys/fs/cgroup/", tok);
-                        if (!target)
-                                return log_oom();
-
-                        r = symlink_idempotent(controller, target, false);
-                        if (r == -EINVAL)
-                                return log_error_errno(r, "Invalid existing symlink for combined hierarchy: %m");
-                        if (r < 0)
-                                return log_error_errno(r, "Failed to create symlink for combined hierarchy: %m");
-                }
-        }
-
-skip_controllers:
-        if (unified_requested >= CGROUP_UNIFIED_SYSTEMD) {
-                r = mount_legacy_cgroup_hierarchy("", SYSTEMD_CGROUP_CONTROLLER_HYBRID, "unified", false);
-                if (r < 0)
-                        return r;
-        }
-
-        r = mount_legacy_cgroup_hierarchy("", SYSTEMD_CGROUP_CONTROLLER_LEGACY, "systemd", false);
-        if (r < 0)
-                return r;
-
-        if (!userns)
-                return mount_nofollow_verbose(LOG_ERR, NULL, cgroup_root, NULL,
-                                              MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME|MS_RDONLY,
-                                              "mode=0755");
-
-        return 0;
-}
-
-/* Mount legacy cgroup hierarchy when cgroup namespaces are unsupported. */
-static int mount_legacy_cgns_unsupported(
-                const char *dest,
-                CGroupUnified unified_requested,
-                bool userns,
-                uid_t uid_shift,
-                uid_t uid_range,
-                const char *selinux_apifs_context) {
-
-        _cleanup_set_free_ Set *controllers = NULL;
-        const char *cgroup_root;
-        int r;
-
-        cgroup_root = prefix_roota(dest, "/sys/fs/cgroup");
-
-        (void) mkdir_p(cgroup_root, 0755);
-
-        /* Mount a tmpfs to /sys/fs/cgroup if it's not mounted there yet. */
-        r = path_is_mount_point_full(cgroup_root, dest, AT_SYMLINK_FOLLOW);
-        if (r < 0)
-                return log_error_errno(r, "Failed to determine if /sys/fs/cgroup is already mounted: %m");
-        if (r == 0) {
-                _cleanup_free_ char *options = NULL;
-
-                r = tmpfs_patch_options("mode=0755" TMPFS_LIMITS_SYS_FS_CGROUP,
-                                        uid_shift == 0 ? UID_INVALID : uid_shift,
-                                        selinux_apifs_context,
-                                        &options);
-                if (r < 0)
-                        return log_oom();
-
-                r = mount_nofollow_verbose(LOG_ERR, "tmpfs", cgroup_root, "tmpfs",
-                                           MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME, options);
-                if (r < 0)
-                        return r;
-        }
-
-        r = cg_all_unified();
-        if (r < 0)
-                return r;
-        if (r > 0)
-                goto skip_controllers;
-
-        r = cg_kernel_controllers(&controllers);
-        if (r < 0)
-                return log_error_errno(r, "Failed to determine cgroup controllers: %m");
-
-        for (;;) {
-                _cleanup_free_ char *controller = NULL, *origin = NULL, *combined = NULL;
-
-                controller = set_steal_first(controllers);
-                if (!controller)
-                        break;
-
-                origin = path_join("/sys/fs/cgroup/", controller);
-                if (!origin)
-                        return log_oom();
-
-                r = readlink_malloc(origin, &combined);
-                if (r == -EINVAL) {
-                        /* Not a symbolic link, but directly a single cgroup hierarchy */
-
-                        r = mount_legacy_cgroup_hierarchy(dest, controller, controller, true);
-                        if (r < 0)
-                                return r;
-
-                } else if (r < 0)
-                        return log_error_errno(r, "Failed to read link %s: %m", origin);
-                else {
-                        _cleanup_free_ char *target = NULL;
-
-                        target = path_join(dest, origin);
-                        if (!target)
-                                return log_oom();
-
-                        /* A symbolic link, a combination of controllers in one hierarchy */
-
-                        if (!filename_is_valid(combined)) {
-                                log_warning("Ignoring invalid combined hierarchy %s.", combined);
-                                continue;
-                        }
-
-                        r = mount_legacy_cgroup_hierarchy(dest, combined, combined, true);
-                        if (r < 0)
-                                return r;
-
-                        r = symlink_idempotent(combined, target, false);
-                        if (r == -EINVAL)
-                                return log_error_errno(r, "Invalid existing symlink for combined hierarchy: %m");
-                        if (r < 0)
-                                return log_error_errno(r, "Failed to create symlink for combined hierarchy: %m");
-                }
-        }
-
-skip_controllers:
-        if (unified_requested >= CGROUP_UNIFIED_SYSTEMD) {
-                r = mount_legacy_cgroup_hierarchy(dest, SYSTEMD_CGROUP_CONTROLLER_HYBRID, "unified", false);
-                if (r < 0)
-                        return r;
-        }
-
-        r = mount_legacy_cgroup_hierarchy(dest, SYSTEMD_CGROUP_CONTROLLER_LEGACY, "systemd", false);
-        if (r < 0)
-                return r;
-
-        return mount_nofollow_verbose(LOG_ERR, NULL, cgroup_root, NULL,
-                                      MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME|MS_RDONLY,
-                                      "mode=0755");
-}
-
-static int mount_unified_cgroups(const char *dest) {
+int mount_cgroups(const char *dest, bool accept_existing) {
         const char *p;
         int r;
 
-        assert(dest);
-
         p = prefix_roota(dest, "/sys/fs/cgroup");
 
         (void) mkdir_p(p, 0755);
@@ -552,8 +146,10 @@ static int mount_unified_cgroups(const char *dest) {
         if (r < 0)
                 return log_error_errno(r, "Failed to determine if %s is mounted already: %m", p);
         if (r > 0) {
-                p = prefix_roota(dest, "/sys/fs/cgroup/cgroup.procs");
-                if (access(p, F_OK) >= 0)
+                if (!accept_existing)
+                        return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Refusing existing cgroupfs mount: %s", p);
+
+                if (access(strjoina(p, "/cgroup.procs"), F_OK) >= 0)
                         return 0;
                 if (errno != ENOENT)
                         return log_error_errno(errno, "Failed to determine if mount point %s contains the unified cgroup hierarchy: %m", p);
@@ -562,51 +158,14 @@ static int mount_unified_cgroups(const char *dest) {
                                        "%s is already mounted but not a unified cgroup hierarchy. Refusing.", p);
         }
 
-        return mount_nofollow_verbose(LOG_ERR, "cgroup", p, "cgroup2", MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL);
+        return mount_cgroupfs(p);
 }
 
-int mount_cgroups(
-                const char *dest,
-                CGroupUnified unified_requested,
-                bool userns,
-                uid_t uid_shift,
-                uid_t uid_range,
-                const char *selinux_apifs_context,
-                bool use_cgns) {
-
-        if (unified_requested >= CGROUP_UNIFIED_ALL)
-                return mount_unified_cgroups(dest);
-        if (use_cgns)
-                return mount_legacy_cgns_supported(dest, unified_requested, userns, uid_shift, uid_range, selinux_apifs_context);
-
-        return mount_legacy_cgns_unsupported(dest, unified_requested, userns, uid_shift, uid_range, selinux_apifs_context);
-}
-
-static int mount_systemd_cgroup_writable_one(const char *root, const char *own) {
-        int r;
-
-        assert(root);
-        assert(own);
-
-        /* Make our own cgroup a (writable) bind mount */
-        r = mount_nofollow_verbose(LOG_ERR, own, own, NULL, MS_BIND, NULL);
-        if (r < 0)
-                return r;
-
-        /* And then remount the systemd cgroup root read-only */
-        return mount_nofollow_verbose(LOG_ERR, NULL, root, NULL,
-                                      MS_BIND|MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, NULL);
-}
-
-int mount_systemd_cgroup_writable(
-                const char *dest,
-                CGroupUnified unified_requested) {
-
+int bind_mount_cgroup_hierarchy(void) {
         _cleanup_free_ char *own_cgroup_path = NULL;
-        const char *root, *own;
         int r;
 
-        assert(dest);
+        /* NB: This must be called from the inner child, with /sys/fs/cgroup/ being a bind mount in mountns! */
 
         r = cg_pid_get_path(NULL, 0, &own_cgroup_path);
         if (r < 0)
@@ -616,25 +175,14 @@ int mount_systemd_cgroup_writable(
         if (path_equal(own_cgroup_path, "/"))
                 return 0;
 
-        if (unified_requested >= CGROUP_UNIFIED_ALL) {
+        const char *p = strjoina("/sys/fs/cgroup", own_cgroup_path);
 
-                root = prefix_roota(dest, "/sys/fs/cgroup");
-                own = strjoina(root, own_cgroup_path);
+        /* Make our own cgroup a (writable) bind mount */
+        r = mount_nofollow_verbose(LOG_ERR, p, p, NULL, MS_BIND, NULL);
+        if (r < 0)
+                return r;
 
-        } else {
-
-                if (unified_requested >= CGROUP_UNIFIED_SYSTEMD) {
-                        root = prefix_roota(dest, "/sys/fs/cgroup/unified");
-                        own = strjoina(root, own_cgroup_path);
-
-                        r = mount_systemd_cgroup_writable_one(root, own);
-                        if (r < 0)
-                                return r;
-                }
-
-                root = prefix_roota(dest, "/sys/fs/cgroup/systemd");
-                own = strjoina(root, own_cgroup_path);
-        }
-
-        return mount_systemd_cgroup_writable_one(root, own);
+        /* And then remount the systemd cgroup root read-only */
+        return mount_nofollow_verbose(LOG_ERR, NULL, "/sys/fs/cgroup", NULL,
+                                      MS_BIND|MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, NULL);
 }
diff --git a/src/nspawn/nspawn-cgroup.h b/src/nspawn/nspawn-cgroup.h
index 8f039ffb28..125bbf5f80 100644
--- a/src/nspawn/nspawn-cgroup.h
+++ b/src/nspawn/nspawn-cgroup.h
@@ -4,11 +4,14 @@
 #include <stdbool.h>
 #include <sys/types.h>
 
-#include "cgroup-util.h"
 #include "nspawn-settings.h"
 
-int sync_cgroup(pid_t pid, CGroupUnified unified_requested, uid_t uid_shift);
-int create_subcgroup(pid_t pid, bool keep_unit, CGroupUnified unified_requested, uid_t uid_shift, int userns_fd, UserNamespaceMode userns_mode);
+int create_subcgroup(
+                pid_t pid,
+                bool keep_unit,
+                uid_t uid_shift,
+                int userns_fd,
+                UserNamespaceMode userns_mode);
 
-int mount_cgroups(const char *dest, CGroupUnified unified_requested, bool userns, uid_t uid_shift, uid_t uid_range, const char *selinux_apifs_context, bool use_cgns);
-int mount_systemd_cgroup_writable(const char *dest, CGroupUnified unified_requested);
+int mount_cgroups(const char *dest, bool accept_existing);
+int bind_mount_cgroup_hierarchy(void);
diff --git a/src/nspawn/nspawn-mount.h b/src/nspawn/nspawn-mount.h
index 87b3b91c43..2efcd110fc 100644
--- a/src/nspawn/nspawn-mount.h
+++ b/src/nspawn/nspawn-mount.h
@@ -3,7 +3,6 @@
 
 #include <stdbool.h>
 
-#include "cgroup-util.h"
 #include "volatile-util.h"
 
 typedef enum MountSettingsMask {
diff --git a/src/nspawn/nspawn-util.c b/src/nspawn/nspawn-util.c
deleted file mode 100644
index 2cd73fe87c..0000000000
--- a/src/nspawn/nspawn-util.c
+++ /dev/null
@@ -1,79 +0,0 @@
-/* SPDX-License-Identifier: LGPL-2.1-or-later */
-
-#include "alloc-util.h"
-#include "glob-util.h"
-#include "log.h"
-#include "nspawn-util.h"
-#include "parse-util.h"
-#include "path-util.h"
-#include "string-util.h"
-
-int systemd_installation_has_version(const char *root, const char *minimal_version) {
-        bool found = false;
-        int r;
-
-        /* Try to guess if systemd installation is later than the specified version. This
-         * is hacky and likely to yield false negatives, particularly if the installation
-         * is non-standard. False positives should be relatively rare.
-         */
-
-        FOREACH_STRING(pattern,
-                       /* /lib works for systems without usr-merge, and for systems with a sane
-                        * usr-merge, where /lib is a symlink to /usr/lib. /usr/lib is necessary
-                        * for Gentoo which does a merge without making /lib a symlink.
-                        * Also support multiarch paths von Debian/Ubuntu; *-linux-* is a small
-                        * optimization based on the naming scheme of existing multiarch tuples.
-                        */
-                       "/lib/systemd/libsystemd-shared-*.so",
-                       "/lib64/systemd/libsystemd-shared-*.so",
-                       "/usr/lib/*-linux-*/systemd/libsystemd-shared-*.so",
-                       "/usr/lib/systemd/libsystemd-shared-*.so",
-                       "/usr/lib64/systemd/libsystemd-shared-*.so") {
-
-                _cleanup_strv_free_ char **names = NULL;
-                _cleanup_free_ char *path = NULL;
-                char *c;
-
-                path = path_join(root, pattern);
-                if (!path)
-                        return -ENOMEM;
-
-                r = glob_extend(&names, path, 0);
-                if (r == -ENOENT)
-                        continue;
-                if (r < 0)
-                        return r;
-
-                assert_se(c = endswith(path, "*.so"));
-                *c = '\0'; /* truncate the glob part */
-
-                STRV_FOREACH(name, names) {
-                        _cleanup_free_ char *bn = NULL;
-                        /* This is most likely to run only once, hence let's not optimize anything. */
-                        char *t, *t2;
-
-                        if (path_extract_filename(*name, &bn) < 0)
-                                continue;
-
-                        t = startswith(bn, "libsystemd-shared-");
-                        if (!t)
-                                continue;
-
-                        t2 = endswith(t, ".so");
-                        if (!t2)
-                                continue;
-                        *t2 = '\0';
-
-                        found = true;
-
-                        r = strverscmp_improved(t, minimal_version);
-                        log_debug("Found libsystemd shared at \"%s.so\", version %s (%s).",
-                                  *name, t,
-                                  r >= 0 ? "OK" : "too old");
-                        if (r >= 0)
-                                return true;
-                }
-        }
-
-        return !found ? -ENOENT : false;
-}
diff --git a/src/nspawn/nspawn-util.h b/src/nspawn/nspawn-util.h
deleted file mode 100644
index e83cd564da..0000000000
--- a/src/nspawn/nspawn-util.h
+++ /dev/null
@@ -1,4 +0,0 @@
-/* SPDX-License-Identifier: LGPL-2.1-or-later */
-#pragma once
-
-int systemd_installation_has_version(const char *root, const char *minimal_version);
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index 17b0c85185..2dcab7d379 100644
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -32,6 +32,7 @@
 #include "bus-util.h"
 #include "cap-list.h"
 #include "capability-util.h"
+#include "cgroup-setup.h"
 #include "cgroup-util.h"
 #include "chase.h"
 #include "chattr-util.h"
@@ -77,7 +78,6 @@
 #include "nspawn-settings.h"
 #include "nspawn-setuid.h"
 #include "nspawn-stub-pid1.h"
-#include "nspawn-util.h"
 #include "nspawn.h"
 #include "nsresource.h"
 #include "nulstr-util.h"
@@ -201,7 +201,6 @@ static UserNamespaceMode arg_userns_mode; /* initialized depending on arg_privil
 static uid_t arg_uid_shift = UID_INVALID, arg_uid_range = 0x10000U;
 static UserNamespaceOwnership arg_userns_ownership = _USER_NAMESPACE_OWNERSHIP_INVALID;
 static int arg_kill_signal = 0;
-static CGroupUnified arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_UNKNOWN;
 static SettingsMask arg_settings_mask = 0;
 static int arg_settings_trusted = -1;
 static char **arg_parameters = NULL;
@@ -487,77 +486,6 @@ static int custom_mount_check_all(void) {
         return 0;
 }
 
-static int detect_unified_cgroup_hierarchy_from_environment(void) {
-        const char *e, *var = "SYSTEMD_NSPAWN_UNIFIED_HIERARCHY";
-        int r;
-
-        /* Allow the user to control whether the unified hierarchy is used */
-
-        e = getenv(var);
-        if (!e) {
-                /* $UNIFIED_CGROUP_HIERARCHY has been renamed to $SYSTEMD_NSPAWN_UNIFIED_HIERARCHY. */
-                var = "UNIFIED_CGROUP_HIERARCHY";
-                e = getenv(var);
-        }
-
-        if (!isempty(e)) {
-                r = parse_boolean(e);
-                if (r < 0)
-                        return log_error_errno(r, "Failed to parse $%s: %m", var);
-                if (r > 0)
-                        arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
-                else
-                        arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
-        }
-
-        return 0;
-}
-
-static int detect_unified_cgroup_hierarchy_from_image(const char *directory) {
-        int r;
-
-        if (arg_userns_mode == USER_NAMESPACE_MANAGED) {
-                /* We only support the unified mode when running unprivileged */
-                arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
-                return 0;
-        }
-
-        /* Let's inherit the mode to use from the host system, but let's take into consideration what systemd
-         * in the image actually supports. */
-        r = cg_all_unified();
-        if (r < 0)
-                return log_error_errno(r, "Failed to determine whether we are in all unified mode.");
-        if (r > 0) {
-                /* Unified cgroup hierarchy support was added in 230. Unfortunately the detection
-                 * routine only detects 231, so we'll have a false negative here for 230. If there is no
-                 * systemd installation in the container, we use the unified cgroup hierarchy. */
-                r = systemd_installation_has_version(directory, "230");
-                if (r < 0 && r != -ENOENT)
-                        return log_error_errno(r, "Failed to determine systemd version in container: %m");
-                if (r == 0)
-                        arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
-                else
-                        arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
-        } else if (cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0) {
-                /* Mixed cgroup hierarchy support was added in 233. If there is no systemd installation in
-                 * the container, we use the unified cgroup hierarchy. */
-                r = systemd_installation_has_version(directory, "233");
-                if (r < 0 && r != -ENOENT)
-                        return log_error_errno(r, "Failed to determine systemd version in container: %m");
-                if (r == 0)
-                        arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
-                else
-                        arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_SYSTEMD;
-        } else
-                arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
-
-        log_debug("Using %s hierarchy for container.",
-                  arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_NONE ? "legacy" :
-                  arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_SYSTEMD ? "hybrid" : "unified");
-
-        return 0;
-}
-
 static int parse_capability_spec(const char *spec, uint64_t *ret_mask) {
         uint64_t mask = 0;
         int r;
@@ -692,7 +620,7 @@ static int parse_environment(void) {
         else if (r != -ENXIO)
                 log_debug_errno(r, "Failed to parse $SYSTEMD_SUPPRESS_SYNC, ignoring: %m");
 
-        return detect_unified_cgroup_hierarchy_from_environment();
+        return 0;
 }
 
 static int parse_argv(int argc, char *argv[]) {
@@ -1682,25 +1610,6 @@ static int verify_arguments(void) {
         if (arg_userns_mode == USER_NAMESPACE_MANAGED && !arg_private_network)
                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Managed user namespace operation requires private networking, as otherwise /sys/ may not be mounted.");
 
-        if (arg_start_mode == START_PID2 && arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
-                /* If we are running the stub init in the container, we don't need to look at what the init
-                 * in the container supports, because we are not using it. Let's immediately pick the right
-                 * setting based on the host system configuration.
-                 *
-                 * We only do this, if the user didn't use an environment variable to override the detection.
-                 */
-
-                r = cg_all_unified();
-                if (r < 0)
-                        return log_error_errno(r, "Failed to determine whether we are in all unified mode.");
-                if (r > 0)
-                        arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
-                else if (cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0)
-                        arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_SYSTEMD;
-                else
-                        arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
-        }
-
         if (!(arg_clone_ns_flags & CLONE_NEWPID) ||
             !(arg_clone_ns_flags & CLONE_NEWUTS)) {
                 arg_register = false;
@@ -3432,16 +3341,10 @@ static int inner_child(
                 r = unshare(CLONE_NEWCGROUP);
                 if (r < 0)
                         return log_error_errno(errno, "Failed to unshare cgroup namespace: %m");
-                r = mount_cgroups(
-                                "",
-                                arg_unified_cgroup_hierarchy,
-                                arg_userns_mode != USER_NAMESPACE_NO,
-                                arg_uid_shift,
-                                arg_uid_range,
-                                arg_selinux_apifs_context,
-                                true);
+
+                r = mount_cgroups(/* dest = */ NULL, /* accept_existing = */ false);
         } else
-                r = mount_systemd_cgroup_writable("", arg_unified_cgroup_hierarchy);
+                r = bind_mount_cgroup_hierarchy();
         if (r < 0)
                 return r;
 
@@ -4219,21 +4122,6 @@ static int outer_child(
                         return r;
         }
 
-        if (arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
-                /* OK, we don't know yet which cgroup mode to use yet. Let's figure it out, and tell the parent. */
-
-                r = detect_unified_cgroup_hierarchy_from_image(directory);
-                if (r < 0)
-                        return r;
-
-                l = send(fd_outer_socket, &arg_unified_cgroup_hierarchy, sizeof(arg_unified_cgroup_hierarchy), MSG_NOSIGNAL);
-                if (l < 0)
-                        return log_error_errno(errno, "Failed to send cgroup mode: %m");
-                if (l != sizeof(arg_unified_cgroup_hierarchy))
-                        return log_error_errno(SYNTHETIC_ERRNO(EIO),
-                                               "Short write while sending cgroup mode.");
-        }
-
         r = recursive_chown(directory, chown_uid, chown_range);
         if (r < 0)
                 return r;
@@ -4329,14 +4217,7 @@ static int outer_child(
         (void) write_string_filef(p, WRITE_STRING_FILE_CREATE|WRITE_STRING_FILE_MODE_0444, SD_ID128_UUID_FORMAT_STR, SD_ID128_FORMAT_VAL(arg_uuid));
 
         if (!arg_use_cgns) {
-                r = mount_cgroups(
-                                directory,
-                                arg_unified_cgroup_hierarchy,
-                                arg_userns_mode != USER_NAMESPACE_NO,
-                                chown_uid,
-                                chown_range,
-                                arg_selinux_apifs_context,
-                                false);
+                r = mount_cgroups(directory, /* accept_existing = */ true);
                 if (r < 0)
                         return r;
         }
@@ -5378,16 +5259,6 @@ static int run_container(
                 }
         }
 
-        if (arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
-                /* The child let us know the support cgroup mode it might have read from the image. */
-                l = recv(fd_outer_socket_pair[0], &arg_unified_cgroup_hierarchy, sizeof(arg_unified_cgroup_hierarchy), 0);
-                if (l < 0)
-                        return log_error_errno(errno, "Failed to read cgroup mode: %m");
-                if (l != sizeof(arg_unified_cgroup_hierarchy))
-                        return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading cgroup mode (%zi bytes).%s",
-                                               l, l == 0 ? " The child is most likely dead." : "");
-        }
-
         /* Wait for the outer child. */
         r = wait_for_terminate_and_check("(sd-namespace)", *pid, WAIT_LOG_ABNORMAL);
         if (r < 0)
@@ -5582,17 +5453,12 @@ static int run_container(
         r = create_subcgroup(
                         *pid,
                         arg_keep_unit,
-                        arg_unified_cgroup_hierarchy,
                         arg_uid_shift,
                         userns_fd,
                         arg_userns_mode);
         if (r < 0)
                 return r;
 
-        r = sync_cgroup(*pid, arg_unified_cgroup_hierarchy, arg_uid_shift);
-        if (r < 0)
-                return r;
-
         /* Notify the child that the parent is ready with all its setup (including cgroup-ification), and
          * that the child can now hand over control to the code to run inside the container. */
         (void) barrier_place(&barrier); /* #4 */
@@ -5991,6 +5857,15 @@ static int run(int argc, char *argv[]) {
         if (arg_cleanup)
                 return do_cleanup();
 
+        r = cg_has_legacy();
+        if (r < 0)
+                goto finish;
+        if (r > 0) {
+                r = log_error_errno(SYNTHETIC_ERRNO(EPROTO),
+                                    "Detected host uses legacy cgroup v1 hierarchy, refusing.");
+                goto finish;
+        }
+
         r = cant_be_in_netns();
         if (r < 0)
                 goto finish;
@@ -6021,12 +5896,6 @@ static int run(int argc, char *argv[]) {
         if (!arg_private_network && arg_userns_mode != USER_NAMESPACE_NO && arg_uid_shift > 0)
                 arg_caps_retain &= ~(UINT64_C(1) << CAP_NET_BIND_SERVICE);
 
-        r = cg_unified(); /* initialize cache early */
-        if (r < 0) {
-                log_error_errno(r, "Failed to determine whether the unified cgroups hierarchy is used: %m");
-                goto finish;
-        }
-
         r = verify_arguments();
         if (r < 0)
                 goto finish;
@@ -6039,19 +5908,6 @@ static int run(int argc, char *argv[]) {
         if (r < 0)
                 goto finish;
 
-        /* Reapply environment settings. */
-        (void) detect_unified_cgroup_hierarchy_from_environment();
-
-        if (arg_userns_mode == USER_NAMESPACE_MANAGED) {
-                r = cg_all_unified();
-                if (r < 0) {
-                        log_error_errno(r, "Failed to determine if we are in unified cgroupv2 mode: %m");
-                        goto finish;
-                }
-                if (r == 0)
-                        return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "Managed user namespace operation only supported in unified cgroupv2 mode.");
-        }
-
         /* Ignore SIGPIPE here, because we use splice() on the ptyfwd stuff and that will generate SIGPIPE if
          * the result is closed. Note that the container payload child will reset signal mask+handler anyway,
          * so just turning this off here means we only turn it off in nspawn itself, not any children. */
diff --git a/src/nspawn/test-nspawn-util.c b/src/nspawn/test-nspawn-util.c
deleted file mode 100644
index 45fc8ad927..0000000000
--- a/src/nspawn/test-nspawn-util.c
+++ /dev/null
@@ -1,31 +0,0 @@
-/* SPDX-License-Identifier: LGPL-2.1-or-later */
-
-#include "nspawn-util.h"
-#include "rm-rf.h"
-#include "strv.h"
-#include "tests.h"
-#include "tmpfile-util.h"
-
-TEST(systemd_installation_has_version) {
-        int r;
-
-        FOREACH_STRING(version, "0", "231", PROJECT_VERSION_FULL, "999") {
-                r = systemd_installation_has_version(saved_argv[1], version);
-                /* The build environment may not have a systemd installation. */
-                if (r == -ENOENT)
-                        continue;
-                ASSERT_OK(r);
-                log_info("%s has systemd >= %s: %s",
-                         saved_argv[1] ?: "Current installation", version, yes_no(r));
-        }
-
-        _cleanup_(rm_rf_physical_and_freep) char *t = NULL;
-        ASSERT_OK(mkdtemp_malloc(NULL, &t));
-
-        ASSERT_ERROR(systemd_installation_has_version(t, PROJECT_VERSION_FULL), ENOENT);
-}
-
-/* This program can be called with a path to an installation root.
- * For example: build/test-nspawn-util /var/lib/machines/rawhide
- */
-DEFINE_TEST_MAIN(LOG_DEBUG);
diff --git a/src/shared/cgroup-setup.c b/src/shared/cgroup-setup.c
index 76658df41a..269824dfc2 100644
--- a/src/shared/cgroup-setup.c
+++ b/src/shared/cgroup-setup.c
@@ -868,91 +868,6 @@ int cg_trim_v1_controllers(CGroupMask supported, CGroupMask mask, const char *pa
         return r;
 }
 
-int cg_install_release_agent(const char *controller, const char *agent) {
-        _cleanup_free_ char *fs = NULL, *contents = NULL;
-        const char *sc;
-        int r;
-
-        assert(agent);
-
-        r = cg_unified_controller(controller);
-        if (r < 0)
-                return r;
-        if (r > 0) /* doesn't apply to unified hierarchy */
-                return -EOPNOTSUPP;
-
-        r = cg_get_path(controller, NULL, "release_agent", &fs);
-        if (r < 0)
-                return r;
-
-        r = read_one_line_file(fs, &contents);
-        if (r < 0)
-                return r;
-
-        sc = strstrip(contents);
-        if (isempty(sc)) {
-                r = write_string_file(fs, agent, WRITE_STRING_FILE_DISABLE_BUFFER);
-                if (r < 0)
-                        return r;
-        } else if (!path_equal(sc, agent))
-                return -EEXIST;
-
-        fs = mfree(fs);
-        r = cg_get_path(controller, NULL, "notify_on_release", &fs);
-        if (r < 0)
-                return r;
-
-        contents = mfree(contents);
-        r = read_one_line_file(fs, &contents);
-        if (r < 0)
-                return r;
-
-        sc = strstrip(contents);
-        if (streq(sc, "0")) {
-                r = write_string_file(fs, "1", WRITE_STRING_FILE_DISABLE_BUFFER);
-                if (r < 0)
-                        return r;
-
-                return 1;
-        }
-
-        if (!streq(sc, "1"))
-                return -EIO;
-
-        return 0;
-}
-
-int cg_uninstall_release_agent(const char *controller) {
-        _cleanup_free_ char *fs = NULL;
-        int r;
-
-        r = cg_unified_controller(controller);
-        if (r < 0)
-                return r;
-        if (r > 0) /* Doesn't apply to unified hierarchy */
-                return -EOPNOTSUPP;
-
-        r = cg_get_path(controller, NULL, "notify_on_release", &fs);
-        if (r < 0)
-                return r;
-
-        r = write_string_file(fs, "0", WRITE_STRING_FILE_DISABLE_BUFFER);
-        if (r < 0)
-                return r;
-
-        fs = mfree(fs);
-
-        r = cg_get_path(controller, NULL, "release_agent", &fs);
-        if (r < 0)
-                return r;
-
-        r = write_string_file(fs, "", WRITE_STRING_FILE_DISABLE_BUFFER);
-        if (r < 0)
-                return r;
-
-        return 0;
-}
-
 int cg_has_legacy(void) {
         struct statfs fs;
 
diff --git a/src/shared/cgroup-setup.h b/src/shared/cgroup-setup.h
index 7f0a8c73bb..b20de46894 100644
--- a/src/shared/cgroup-setup.h
+++ b/src/shared/cgroup-setup.h
@@ -38,7 +38,4 @@ int cg_migrate_recursive_fallback(const char *cfrom, const char *pfrom, const ch
 int cg_migrate_v1_controllers(CGroupMask supported, CGroupMask mask, const char *from, cg_migrate_callback_t to_callback, void *userdata);
 int cg_trim_v1_controllers(CGroupMask supported, CGroupMask mask, const char *path, bool delete_root);
 
-int cg_install_release_agent(const char *controller, const char *agent);
-int cg_uninstall_release_agent(const char *controller);
-
 int cg_has_legacy(void);
diff --git a/src/shared/mount-setup.c b/src/shared/mount-setup.c
index ad2327e084..df28180624 100644
--- a/src/shared/mount-setup.c
+++ b/src/shared/mount-setup.c
@@ -66,6 +66,21 @@ static bool cgroupfs_recursiveprot_supported(void) {
         return r > 0;
 }
 
+int mount_cgroupfs(const char *path) {
+        assert(path);
+
+        /* Mount a separate cgroupfs instance, taking all options we initial set into account. This is
+         * especially useful when cgroup namespace is *not* employed, since the kernel overrides all
+         * previous options if a new mount is established in initial cgns (c.f.
+         * https://github.com/torvalds/linux/blob/b69bb476dee99d564d65d418e9a20acca6f32c3f/kernel/cgroup/cgroup.c#L1984)
+         *
+         * The options shall be kept in sync with those in mount_table below. */
+
+        return mount_nofollow_verbose(LOG_ERR, "cgroup2", path, "cgroup2",
+                                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
+                                      cgroupfs_recursiveprot_supported() ? "nsdelegate,memory_recursiveprot" : "nsdelegate");
+}
+
 static const MountPoint mount_table[] = {
         { "proc",        "/proc",                     "proc",       NULL,                                       MS_NOSUID|MS_NOEXEC|MS_NODEV,
           NULL,          MNT_FATAL|MNT_IN_CONTAINER|MNT_FOLLOW_SYMLINK },
diff --git a/src/shared/mount-setup.h b/src/shared/mount-setup.h
index 34de1dad0b..58a1b7619c 100644
--- a/src/shared/mount-setup.h
+++ b/src/shared/mount-setup.h
@@ -8,3 +8,5 @@ bool mount_point_ignore(const char *path);
 
 int mount_setup_early(void);
 int mount_setup(bool loaded_policy, bool leave_propagation);
+
+int mount_cgroupfs(const char *path);
diff --git a/test/units/TEST-13-NSPAWN.nspawn.sh b/test/units/TEST-13-NSPAWN.nspawn.sh
index 50f54368c7..22b1abd57c 100755
--- a/test/units/TEST-13-NSPAWN.nspawn.sh
+++ b/test/units/TEST-13-NSPAWN.nspawn.sh
@@ -49,15 +49,6 @@ at_exit() {
 
 trap at_exit EXIT
 
-# check cgroup-v2
-IS_CGROUPSV2_SUPPORTED=no
-mkdir -p /tmp/cgroup2
-if mount -t cgroup2 cgroup2 /tmp/cgroup2; then
-    IS_CGROUPSV2_SUPPORTED=yes
-    umount /tmp/cgroup2
-fi
-rmdir /tmp/cgroup2
-
 # check cgroup namespaces
 IS_CGNS_SUPPORTED=no
 if [[ -f /proc/1/ns/cgroup ]]; then
@@ -880,36 +871,30 @@ EOF
 }
 
 matrix_run_one() {
-    local cgroupsv2="${1:?}"
-    local use_cgns="${2:?}"
-    local api_vfs_writable="${3:?}"
+    local use_cgns="${1:?}"
+    local api_vfs_writable="${2:?}"
     local root
 
-    if [[ "$cgroupsv2" == "yes" && "$IS_CGROUPSV2_SUPPORTED" == "no" ]]; then
-        echo >&2 "Unified cgroup hierarchy is not supported, skipping..."
-        return 0
-    fi
-
     if [[ "$use_cgns" == "yes" && "$IS_CGNS_SUPPORTED" == "no" ]];  then
         echo >&2 "CGroup namespaces are not supported, skipping..."
         return 0
     fi
 
-    root="$(mktemp -d "/var/lib/machines/TEST-13-NSPAWN.unified-$1-cgns-$2-api-vfs-writable-$3.XXX")"
+    root="$(mktemp -d "/var/lib/machines/TEST-13-NSPAWN.cgns-$1-api-vfs-writable-$2.XXX")"
     create_dummy_container "$root"
 
-    SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
+    SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
         systemd-nspawn --register=no \
                        --directory="$root" \
                        --boot
 
-    SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
+    SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
         systemd-nspawn --register=no \
                        --directory="$root" \
                        --private-network \
                        --boot
 
-    if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
+    if SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
         systemd-nspawn --register=no \
                        --directory="$root" \
                        --private-users=pick \
@@ -919,7 +904,7 @@ matrix_run_one() {
         [[ "$IS_USERNS_SUPPORTED" == "no" && "$api_vfs_writable" == "network" ]] && return 1
     fi
 
-    if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
+    if SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
         systemd-nspawn --register=no \
                        --directory="$root" \
                        --private-network \
@@ -945,7 +930,7 @@ matrix_run_one() {
     # --network-namespace-path and network-related options cannot be used together
     for net_opt in "${net_opts[@]}"; do
         echo "$netns_opt in combination with $net_opt should fail"
-        if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
+        if SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
             systemd-nspawn --register=no \
                            --directory="$root" \
                            --boot \
@@ -957,7 +942,7 @@ matrix_run_one() {
     done
 
     # allow combination of --network-namespace-path and --private-network
-    SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
+    SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
         systemd-nspawn --register=no \
                        --directory="$root" \
                        --boot \
@@ -967,7 +952,7 @@ matrix_run_one() {
     # test --network-namespace-path works with a network namespace created by "ip netns"
     ip netns add nspawn_test
     netns_opt="--network-namespace-path=/run/netns/nspawn_test"
-    SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
+    SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
         systemd-nspawn --register=no \
                        --directory="$root" \
                        --network-namespace-path=/run/netns/nspawn_test \
@@ -983,10 +968,8 @@ testcase_api_vfs() {
     local api_vfs_writable
 
     for api_vfs_writable in yes no network; do
-        matrix_run_one no  no  $api_vfs_writable
-        matrix_run_one yes no  $api_vfs_writable
-        matrix_run_one no  yes $api_vfs_writable
-        matrix_run_one yes yes $api_vfs_writable
+        matrix_run_one no  $api_vfs_writable
+        matrix_run_one yes $api_vfs_writable
     done
 }