diff --git a/TODO b/TODO
index 27fc5a3a4f..9d09916b28 100644
--- a/TODO
+++ b/TODO
@@ -40,6 +40,10 @@ Features:
 
 * syscall filter: add knowledge about compat syscalls
 
+* syscall filter: don't enforce no new privs?
+
+* syscall filter: option to return EPERM rather than SIGSYS?
+
 * logind: wakelock/opportunistic suspend support
 
 * switch-root: sockets need relabelling
diff --git a/src/journal/sd-journal.c b/src/journal/sd-journal.c
index 497f79cb52..c3f19ca697 100644
--- a/src/journal/sd-journal.c
+++ b/src/journal/sd-journal.c
@@ -1950,6 +1950,8 @@ _public_ int sd_journal_get_cutoff_realtime_usec(sd_journal *j, uint64_t *from,
                 usec_t fr, t;
 
                 r = journal_file_get_cutoff_realtime_usec(f, &fr, &t);
+                if (r == -ENOENT)
+                        continue;
                 if (r < 0)
                         return r;
                 if (r == 0)
@@ -1987,6 +1989,8 @@ _public_ int sd_journal_get_cutoff_monotonic_usec(sd_journal *j, sd_id128_t boot
                 usec_t fr, t;
 
                 r = journal_file_get_cutoff_monotonic_usec(f, boot_id, &fr, &t);
+                if (r == -ENOENT)
+                        continue;
                 if (r < 0)
                         return r;
                 if (r == 0)