diff --git a/coccinelle/errno-wrapper.cocci b/coccinelle/errno-wrapper.cocci
new file mode 100644
index 00000000000..61c87827084
--- /dev/null
+++ b/coccinelle/errno-wrapper.cocci
@@ -0,0 +1,46 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+@@
+expression r;
+@@
+- (r < 0 && ERRNO_IS_TRANSIENT(r))
++ ERRNO_IS_NEG_TRANSIENT(r)
+@@
+expression r;
+@@
+- (r < 0 && ERRNO_IS_DISCONNECT(r))
++ ERRNO_IS_NEG_DISCONNECT(r)
+@@
+expression r;
+@@
+- (r < 0 && ERRNO_IS_ACCEPT_AGAIN(r))
++ ERRNO_IS_NEG_ACCEPT_AGAIN(r)
+@@
+expression r;
+@@
+- (r < 0 && ERRNO_IS_RESOURCE(r))
++ ERRNO_IS_NEG_RESOURCE(r)
+@@
+expression r;
+@@
+- (r < 0 && ERRNO_IS_NOT_SUPPORTED(r))
++ ERRNO_IS_NEG_NOT_SUPPORTED(r)
+@@
+expression r;
+@@
+- (r < 0 && ERRNO_IS_PRIVILEGE(r))
++ ERRNO_IS_NEG_PRIVILEGE(r)
+@@
+expression r;
+@@
+- (r < 0 && ERRNO_IS_DISK_SPACE(r))
++ ERRNO_IS_NEG_DISK_SPACE(r)
+@@
+expression r;
+@@
+- (r < 0 && ERRNO_IS_DEVICE_ABSENT(r))
++ ERRNO_IS_NEG_DEVICE_ABSENT(r)
+@@
+expression r;
+@@
+- (r < 0 && ERRNO_IS_XATTR_ABSENT(r))
++ ERRNO_IS_NEG_XATTR_ABSENT(r)
diff --git a/src/libsystemd/sd-netlink/sd-netlink.c b/src/libsystemd/sd-netlink/sd-netlink.c
index 9d1df723813..ce0687eb57a 100644
--- a/src/libsystemd/sd-netlink/sd-netlink.c
+++ b/src/libsystemd/sd-netlink/sd-netlink.c
@@ -434,7 +434,7 @@ int sd_netlink_wait(sd_netlink *nl, uint64_t timeout_usec) {
                 return 0;
 
         r = netlink_poll(nl, false, timeout_usec);
-        if (r < 0 && ERRNO_IS_TRANSIENT(r)) /* Convert EINTR to "something happened" and give user a chance to run some code before calling back into us */
+        if (ERRNO_IS_NEG_TRANSIENT(r)) /* Convert EINTR to "something happened" and give user a chance to run some code before calling back into us */
                 return 1;
         return r;
 }
diff --git a/src/resolve/resolved-dns-transaction.c b/src/resolve/resolved-dns-transaction.c
index b3d69f455a3..de779695d9b 100644
--- a/src/resolve/resolved-dns-transaction.c
+++ b/src/resolve/resolved-dns-transaction.c
@@ -2099,7 +2099,7 @@ int dns_transaction_go(DnsTransaction *t) {
                 dns_transaction_complete(t, DNS_TRANSACTION_RR_TYPE_UNSUPPORTED);
                 return 0;
         }
-        if (t->scope->protocol == DNS_PROTOCOL_LLMNR && r < 0 && ERRNO_IS_DISCONNECT(r)) {
+        if (t->scope->protocol == DNS_PROTOCOL_LLMNR && ERRNO_IS_NEG_DISCONNECT(r)) {
                 /* On LLMNR, if we cannot connect to a host via TCP when doing reverse lookups. This means we cannot
                  * answer this request with this protocol. */
                 dns_transaction_complete(t, DNS_TRANSACTION_NOT_FOUND);
diff --git a/src/shared/cgroup-show.c b/src/shared/cgroup-show.c
index f2c34069954..0fd8d73303d 100644
--- a/src/shared/cgroup-show.c
+++ b/src/shared/cgroup-show.c
@@ -135,12 +135,12 @@ static int is_delegated(int cgfd, const char *path) {
         assert(cgfd >= 0 || path);
 
         r = getxattr_malloc(cgfd < 0 ? path : FORMAT_PROC_FD_PATH(cgfd), "trusted.delegate", &b);
-        if (r < 0 && ERRNO_IS_XATTR_ABSENT(r)) {
+        if (ERRNO_IS_NEG_XATTR_ABSENT(r)) {
                 /* If the trusted xattr isn't set (preferred), then check the untrusted one. Under the
                  * assumption that whoever is trusted enough to own the cgroup, is also trusted enough to
                  * decide if it is delegated or not this should be safe. */
                 r = getxattr_malloc(cgfd < 0 ? path : FORMAT_PROC_FD_PATH(cgfd), "user.delegate", &b);
-                if (r < 0 && ERRNO_IS_XATTR_ABSENT(r))
+                if (ERRNO_IS_NEG_XATTR_ABSENT(r))
                         return false;
         }
         if (r < 0)
diff --git a/src/shared/varlink.c b/src/shared/varlink.c
index 97f50a5ed25..7685377cba5 100644
--- a/src/shared/varlink.c
+++ b/src/shared/varlink.c
@@ -1279,8 +1279,8 @@ int varlink_wait(Varlink *v, usec_t timeout) {
                 return events;
 
         r = fd_wait_for_event(fd, events, t);
-        if (r < 0 && ERRNO_IS_TRANSIENT(r)) /* Treat EINTR as not a timeout, but also nothing happened, and
-                                             * the caller gets a chance to call back into us */
+        if (ERRNO_IS_NEG_TRANSIENT(r)) /* Treat EINTR as not a timeout, but also nothing happened, and
+                                        * the caller gets a chance to call back into us */
                 return 1;
         if (r <= 0)
                 return r;
diff --git a/src/test/test-architecture.c b/src/test/test-architecture.c
index 043978e9a62..8731e1c3f73 100644
--- a/src/test/test-architecture.c
+++ b/src/test/test-architecture.c
@@ -21,7 +21,7 @@ int main(int argc, char *argv[]) {
         assert_se(architecture_from_string(architecture_to_string(1)) == 1);
 
         v = detect_virtualization();
-        if (v < 0 && ERRNO_IS_PRIVILEGE(v))
+        if (ERRNO_IS_NEG_PRIVILEGE(v))
                 return log_tests_skipped("Cannot detect virtualization");
 
         assert_se(v >= 0);
diff --git a/src/test/test-barrier.c b/src/test/test-barrier.c
index 0538de9949d..7e8bfc0ad65 100644
--- a/src/test/test-barrier.c
+++ b/src/test/test-barrier.c
@@ -429,7 +429,7 @@ static int intro(void) {
          */
 
         Virtualization v = detect_virtualization();
-        if (v < 0 && ERRNO_IS_PRIVILEGE(v))
+        if (ERRNO_IS_NEG_PRIVILEGE(v))
                 return log_tests_skipped("Cannot detect virtualization");
 
         if (v != VIRTUALIZATION_NONE)
diff --git a/src/test/test-blockdev-util.c b/src/test/test-blockdev-util.c
index 4ccb7796073..4002063a198 100644
--- a/src/test/test-blockdev-util.c
+++ b/src/test/test-blockdev-util.c
@@ -8,7 +8,7 @@ static void test_path_is_encrypted_one(const char *p, int expect) {
         int r;
 
         r = path_is_encrypted(p);
-        if (r == -ENOENT || (r < 0 && ERRNO_IS_PRIVILEGE(r)))
+        if (r == -ENOENT || ERRNO_IS_NEG_PRIVILEGE(r))
                 /* This might fail, if btrfs is used and we run in a container. In that case we cannot
                  * resolve the device node paths that BTRFS_IOC_DEV_INFO returns, because the device nodes
                  * are unlikely to exist in the container. But if we can't stat() them we cannot determine
diff --git a/src/test/test-capability.c b/src/test/test-capability.c
index a45e06db22e..2f93fbeedeb 100644
--- a/src/test/test-capability.c
+++ b/src/test/test-capability.c
@@ -39,7 +39,7 @@ static void test_last_cap_file(void) {
         int r;
 
         r = read_one_line_file("/proc/sys/kernel/cap_last_cap", &content);
-        if (r == -ENOENT || (r < 0 && ERRNO_IS_PRIVILEGE(r))) /* kernel pre 3.2 or no access */
+        if (r == -ENOENT || ERRNO_IS_NEG_PRIVILEGE(r)) /* kernel pre 3.2 or no access */
                 return;
         assert_se(r >= 0);
 
@@ -235,7 +235,7 @@ static void test_ensure_cap_64_bit(void) {
         int r;
 
         r = read_one_line_file("/proc/sys/kernel/cap_last_cap", &content);
-        if (r == -ENOENT || (r < 0 && ERRNO_IS_PRIVILEGE(r))) /* kernel pre 3.2 or no access */
+        if (r == -ENOENT || ERRNO_IS_NEG_PRIVILEGE(r)) /* kernel pre 3.2 or no access */
                 return;
         assert_se(r >= 0);
 
diff --git a/src/test/test-fileio.c b/src/test/test-fileio.c
index 51c8d8ee88c..0eb7b073313 100644
--- a/src/test/test-fileio.c
+++ b/src/test/test-fileio.c
@@ -490,7 +490,7 @@ TEST(write_string_file_verify) {
         int r;
 
         r = read_one_line_file("/proc/version", &buf);
-        if (r < 0 && ERRNO_IS_PRIVILEGE(r))
+        if (ERRNO_IS_NEG_PRIVILEGE(r))
                 return;
         assert_se(r >= 0);
         assert_se(buf2 = strjoin(buf, "\n"));
diff --git a/src/test/test-mount-util.c b/src/test/test-mount-util.c
index f0fc0f3e738..0898e68cb5d 100644
--- a/src/test/test-mount-util.c
+++ b/src/test/test-mount-util.c
@@ -470,10 +470,8 @@ TEST(umount_recursive) {
                               FORK_MOUNTNS_SLAVE,
                               NULL);
 
-                if (r < 0 && ERRNO_IS_PRIVILEGE(r)) {
-                        log_notice("Skipping umount_recursive() test, lacking privileges");
-                        return;
-                }
+                if (ERRNO_IS_NEG_PRIVILEGE(r))
+                        return (void) log_notice("Skipping umount_recursive() test, lacking privileges");
 
                 assert_se(r >= 0);
                 if (r == 0) { /* child */
@@ -575,10 +573,9 @@ TEST(bind_mount_submounts) {
 
         assert_se(mkdtemp_malloc(NULL, &a) >= 0);
         r = mount_nofollow_verbose(LOG_INFO, "tmpfs", a, "tmpfs", 0, NULL);
-        if (r < 0 && ERRNO_IS_PRIVILEGE(r)) {
-                (void) log_tests_skipped("Skipping bind_mount_submounts() test, lacking privileges");
-                return;
-        }
+        if (ERRNO_IS_NEG_PRIVILEGE(r))
+                return (void) log_tests_skipped("Skipping bind_mount_submounts() test, lacking privileges");
+
         assert_se(r >= 0);
 
         assert_se(x = path_join(a, "foo"));
diff --git a/src/test/test-procfs-util.c b/src/test/test-procfs-util.c
index 5427e1bec3a..644de5831c1 100644
--- a/src/test/test-procfs-util.c
+++ b/src/test/test-procfs-util.c
@@ -28,14 +28,14 @@ int main(int argc, char *argv[]) {
 
         pid_max = TASKS_MAX;
         r = procfs_get_pid_max(&pid_max);
-        if (r == -ENOENT || (r < 0 && ERRNO_IS_PRIVILEGE(r)))
+        if (r == -ENOENT || ERRNO_IS_NEG_PRIVILEGE(r))
                 return log_tests_skipped_errno(r, "can't get pid max");
         assert(r >= 0);
         log_info("kernel.pid_max: %"PRIu64, pid_max);
 
         threads_max = TASKS_MAX;
         r = procfs_get_threads_max(&threads_max);
-        if (r == -ENOENT || (r < 0 && ERRNO_IS_PRIVILEGE(r)))
+        if (r == -ENOENT || ERRNO_IS_NEG_PRIVILEGE(r))
                 return log_tests_skipped_errno(r, "can't get threads max");
         assert(r >= 0);
         log_info("kernel.threads-max: %"PRIu64, threads_max);
diff --git a/src/tmpfiles/tmpfiles.c b/src/tmpfiles/tmpfiles.c
index 376d3ad7d3f..44302e17d16 100644
--- a/src/tmpfiles/tmpfiles.c
+++ b/src/tmpfiles/tmpfiles.c
@@ -1937,7 +1937,7 @@ static int create_directory_or_subvolume(
         } else
                 r = 0;
 
-        if (!subvol || (r < 0 && ERRNO_IS_NOT_SUPPORTED(r)))
+        if (!subvol || ERRNO_IS_NEG_NOT_SUPPORTED(r))
                 WITH_UMASK(0000)
                         r = mkdirat_label(pfd, bn, mode);