@Andrei, based on your idea of the generator I am preparing something like this: https://github.com/aplanas/dracut-pcr-signature/pull/4 Is still a draft as I am doing something wrong when making the service wanted in some target. For example, if I add it to cryptsetup.target.wants/ then the cycle is something like: [ 2.579258][ T1] systemd[1]: No hostname configured, using default hostname. [ 2.580325][ T1] systemd[1]: Hostname set to <localhost>. [ 2.762644][ T1] systemd[1]: sysinit.target: Found ordering cycle on cryptsetup.target/start [ 2.763712][ T1] systemd[1]: sysinit.target: Found dependency on pcr-signature.service/start [ 2.764745][ T1] systemd[1]: sysinit.target: Found dependency on basic.target/start [ 2.765713][ T1] systemd[1]: sysinit.target: Found dependency on sysinit.target/start [ 2.766668][ T1] systemd[1]: sysinit.target: Job cryptsetup.target/start deleted to break ordering cycle starting with sysinit.target/start [ SKIP ] Ordering cycle found, skipping Local Encrypted Volumes And then I add it to initrd.target.wants, the cycle gets extended with a "Found dependency or cryptsetupt-pre.target/start" I would love a review from your side on the code, but I think that if I figure out the cycle issue this could resolve the races in the code.