diff --git a/src/cryptsetup/cryptsetup.c b/src/cryptsetup/cryptsetup.c
index a18b4e40f2..e1ceae06fa 100644
--- a/src/cryptsetup/cryptsetup.c
+++ b/src/cryptsetup/cryptsetup.c
@@ -14,6 +14,7 @@
 #include "escape.h"
 #include "fileio.h"
 #include "log.h"
+#include "main-func.h"
 #include "mount-util.h"
 #include "parse-util.h"
 #include "path-util.h"
@@ -53,6 +54,11 @@ static uint64_t arg_offset = 0;
 static uint64_t arg_skip = 0;
 static usec_t arg_timeout = USEC_INFINITY;
 
+STATIC_DESTRUCTOR_REGISTER(arg_cipher, freep);
+STATIC_DESTRUCTOR_REGISTER(arg_hash, freep);
+STATIC_DESTRUCTOR_REGISTER(arg_header, freep);
+STATIC_DESTRUCTOR_REGISTER(arg_tcrypt_keyfiles, strv_freep);
+
 /* Options Debian's crypttab knows we don't:
 
     precheck=
@@ -595,18 +601,16 @@ static int help(void) {
         return 0;
 }
 
-int main(int argc, char *argv[]) {
+static int run(int argc, char *argv[]) {
         _cleanup_(crypt_freep) struct crypt_device *cd = NULL;
-        int r = -EINVAL;
+        int r;
 
-        if (argc <= 1) {
-                r = help();
-                goto finish;
-        }
+        if (argc <= 1)
+                return help();
 
         if (argc < 3) {
                 log_error("This program requires at least two arguments.");
-                goto finish;
+                return -EINVAL;
         }
 
         log_setup_service();
@@ -624,7 +628,7 @@ int main(int argc, char *argv[]) {
 
                 if (argc < 4) {
                         log_error("attach requires at least two arguments.");
-                        goto finish;
+                        return -EINVAL;
                 }
 
                 if (argc >= 5 &&
@@ -639,8 +643,9 @@ int main(int argc, char *argv[]) {
                 }
 
                 if (argc >= 6 && argv[5][0] && !streq(argv[5], "-")) {
-                        if (parse_options(argv[5]) < 0)
-                                goto finish;
+                        r = parse_options(argv[5]);
+                        if (r < 0)
+                                return r;
                 }
 
                 /* A delicious drop of snake oil */
@@ -651,18 +656,15 @@ int main(int argc, char *argv[]) {
                         r = crypt_init(&cd, arg_header);
                 } else
                         r = crypt_init(&cd, argv[3]);
-                if (r < 0) {
-                        log_error_errno(r, "crypt_init() failed: %m");
-                        goto finish;
-                }
+                if (r < 0)
+                        return log_error_errno(r, "crypt_init() failed: %m");
 
                 crypt_set_log_callback(cd, cryptsetup_log_glue, NULL);
 
                 status = crypt_status(cd, argv[2]);
                 if (IN_SET(status, CRYPT_ACTIVE, CRYPT_BUSY)) {
                         log_info("Volume %s already active.", argv[2]);
-                        r = 0;
-                        goto finish;
+                        return 0;
                 }
 
                 if (arg_readonly)
@@ -695,7 +697,7 @@ int main(int argc, char *argv[]) {
                                 if (r == -EAGAIN)
                                         continue;
                                 if (r < 0)
-                                        goto finish;
+                                        return r;
                         }
 
                         if (streq_ptr(arg_type, CRYPT_TCRYPT))
@@ -713,18 +715,15 @@ int main(int argc, char *argv[]) {
                                 key_file = NULL;
                                 continue;
                         }
-                        if (r != -EPERM) {
-                                log_error_errno(r, "Failed to activate: %m");
-                                goto finish;
-                        }
+                        if (r != -EPERM)
+                                return log_error_errno(r, "Failed to activate: %m");
 
                         log_warning("Invalid passphrase.");
                 }
 
                 if (arg_tries != 0 && tries >= arg_tries) {
                         log_error("Too many attempts; giving up.");
-                        r = -EPERM;
-                        goto finish;
+                        return -EPERM;
                 }
 
         } else if (streq(argv[1], "detach")) {
@@ -732,34 +731,23 @@ int main(int argc, char *argv[]) {
                 r = crypt_init_by_name(&cd, argv[2]);
                 if (r == -ENODEV) {
                         log_info("Volume %s already inactive.", argv[2]);
-                        r = 0;
-                        goto finish;
-                }
-                if (r < 0) {
-                        log_error_errno(r, "crypt_init_by_name() failed: %m");
-                        goto finish;
+                        return 0;
                 }
+                if (r < 0)
+                        return log_error_errno(r, "crypt_init_by_name() failed: %m");
 
                 crypt_set_log_callback(cd, cryptsetup_log_glue, NULL);
 
                 r = crypt_deactivate(cd, argv[2]);
-                if (r < 0) {
-                        log_error_errno(r, "Failed to deactivate: %m");
-                        goto finish;
-                }
+                if (r < 0)
+                        return log_error_errno(r, "Failed to deactivate: %m");
 
         } else {
                 log_error("Unknown verb %s.", argv[1]);
-                goto finish;
+                return -EINVAL;
         }
 
-        r = 0;
-
-finish:
-        free(arg_cipher);
-        free(arg_hash);
-        free(arg_header);
-        strv_free(arg_tcrypt_keyfiles);
-
-        return r < 0 ? EXIT_FAILURE : EXIT_SUCCESS;
+        return 0;
 }
+
+DEFINE_MAIN_FUNCTION(run);