diff --git a/clients/cloud-setup/nm-http-client.c b/clients/cloud-setup/nm-http-client.c
index 946ed8ce93..b4260ffee6 100644
--- a/clients/cloud-setup/nm-http-client.c
+++ b/clients/cloud-setup/nm-http-client.c
@@ -438,8 +438,8 @@ _poll_get_probe_finish_fcn (GObject *source,
 	_nm_unused gs_unref_object GTask *task = poll_get_data->task; /* balance ref from _poll_get_probe_start_fcn() */
 	gboolean success;
 	gs_free_error GError *local_error = NULL;
-	long response_code;
 	gs_unref_bytes GBytes *response_data = NULL;
+	long response_code = -1;
 
 	success = nm_http_client_get_finish (g_task_get_source_object (poll_get_data->task),
 	                                     result,
diff --git a/libnm-core/nm-keyfile/nm-keyfile-utils.c b/libnm-core/nm-keyfile/nm-keyfile-utils.c
index 0ffce40b96..01b42ac7fc 100644
--- a/libnm-core/nm-keyfile/nm-keyfile-utils.c
+++ b/libnm-core/nm-keyfile/nm-keyfile-utils.c
@@ -144,12 +144,12 @@ nm_keyfile_plugin_kf_get_integer_list_uint (GKeyFile *key_file,
 	gs_free guint *int_values = NULL;
 	gsize i, num_ints;
 
+	NM_SET_OUT (out_length, 0);
+
 	g_return_val_if_fail (key_file != NULL, NULL);
 	g_return_val_if_fail (group_name != NULL, NULL);
 	g_return_val_if_fail (key != NULL, NULL);
 
-	NM_SET_OUT (out_length, 0);
-
 	values = nm_keyfile_plugin_kf_get_string_list (key_file, group_name, key, &num_ints, &key_file_error);
 
 	if (key_file_error)
diff --git a/libnm-core/nm-keyfile/nm-keyfile.c b/libnm-core/nm-keyfile/nm-keyfile.c
index 77af2b6492..79f9c5f913 100644
--- a/libnm-core/nm-keyfile/nm-keyfile.c
+++ b/libnm-core/nm-keyfile/nm-keyfile.c
@@ -2296,9 +2296,9 @@ wired_s390_options_writer_full (KeyfileWriterInfo *info,
 
 	n = nm_setting_wired_get_num_s390_options (s_wired);
 	for (i = 0; i < n; i++) {
+		gs_free char *key_to_free = NULL;
 		const char *opt_key;
 		const char *opt_val;
-		gs_free char *key_to_free = NULL;
 
 		nm_setting_wired_get_s390_option (s_wired, i, &opt_key, &opt_val);
 		nm_keyfile_plugin_kf_set_string (info->keyfile,
diff --git a/libnm-core/nm-setting-bridge.c b/libnm-core/nm-setting-bridge.c
index 2ead27393e..5082547e86 100644
--- a/libnm-core/nm-setting-bridge.c
+++ b/libnm-core/nm-setting-bridge.c
@@ -268,6 +268,13 @@ nm_bridge_vlan_get_vid_range (const NMBridgeVlan *vlan,
                               guint16 *vid_start,
                               guint16 *vid_end)
 {
+	/* with LTO and optimization, the compiler complains that the
+	 * output variables are not initialized. In practice, the function
+	 * only sets the output on success. But make the compiler happy.
+	 */
+	NM_SET_OUT (vid_start, 0);
+	NM_SET_OUT (vid_end, 0);
+
 	g_return_val_if_fail (NM_IS_BRIDGE_VLAN (vlan, TRUE), 0);
 
 	NM_SET_OUT (vid_start, vlan->vid_start);
diff --git a/libnm-core/nm-setting-wired.c b/libnm-core/nm-setting-wired.c
index ab13d88a40..8b0f255860 100644
--- a/libnm-core/nm-setting-wired.c
+++ b/libnm-core/nm-setting-wired.c
@@ -490,6 +490,13 @@ nm_setting_wired_get_s390_option (NMSettingWired *setting,
 {
 	NMSettingWiredPrivate *priv;
 
+	/* with LTO and optimization, the compiler complains that the
+	 * output variables are not initialized. In practice, the function
+	 * only sets the output on success. But make the compiler happy.
+	 */
+	NM_SET_OUT (out_key,   NULL);
+	NM_SET_OUT (out_value, NULL);
+
 	g_return_val_if_fail (NM_IS_SETTING_WIRED (setting), FALSE);
 
 	priv = NM_SETTING_WIRED_GET_PRIVATE (setting);
diff --git a/libnm-core/nm-setting-wireguard.c b/libnm-core/nm-setting-wireguard.c
index 2bd633cecb..3b2815c039 100644
--- a/libnm-core/nm-setting-wireguard.c
+++ b/libnm-core/nm-setting-wireguard.c
@@ -592,13 +592,16 @@ nm_wireguard_peer_get_allowed_ip (const NMWireGuardPeer *self,
 {
 	const char *s;
 
+	/* With LTO, the compiler might warn about the g_return_val_if_fail()
+	 * code path not initializing the output argument. Workaround that by
+	 * always setting the out argument. */
+	NM_SET_OUT (out_is_valid, FALSE);
+
 	g_return_val_if_fail (NM_IS_WIREGUARD_PEER (self, TRUE), NULL);
 
 	if (   !self->allowed_ips
-	    || idx >= self->allowed_ips->len) {
-		NM_SET_OUT (out_is_valid, FALSE);
+	    || idx >= self->allowed_ips->len)
 		return NULL;
-	}
 
 	s = self->allowed_ips->pdata[idx];
 	NM_SET_OUT (out_is_valid, s[0] != ALLOWED_IP_INVALID_X);
diff --git a/shared/nm-glib-aux/nm-shared-utils.c b/shared/nm-glib-aux/nm-shared-utils.c
index 681b4dd14a..3d1b0098a7 100644
--- a/shared/nm-glib-aux/nm-shared-utils.c
+++ b/shared/nm-glib-aux/nm-shared-utils.c
@@ -4194,7 +4194,10 @@ nm_utils_hexstr2bin_alloc (const char *hexstr,
 	guint8 *buffer;
 	gsize buffer_len, len;
 
-	g_return_val_if_fail (hexstr, NULL);
+	if (G_UNLIKELY (!hexstr)) {
+		NM_SET_OUT (out_len, 0);
+		g_return_val_if_fail (hexstr, NULL);
+	}
 
 	nm_assert (required_len > 0 || out_len);
 
diff --git a/src/dhcp/nm-dhcp-systemd.c b/src/dhcp/nm-dhcp-systemd.c
index 792dc19a3c..737faad937 100644
--- a/src/dhcp/nm-dhcp-systemd.c
+++ b/src/dhcp/nm-dhcp-systemd.c
@@ -107,7 +107,7 @@ lease_to_ip4_config (NMDedupMultiIndex *multi_idx,
 	guint32 rebinding;
 	gs_free nm_sd_dhcp_option *private_options = NULL;
 
-	g_return_val_if_fail (lease != NULL, NULL);
+	nm_assert (lease != NULL);
 
 	if (sd_dhcp_lease_get_address (lease, &a_address) < 0) {
 		nm_utils_error_set_literal (error, NM_UTILS_ERROR_UNKNOWN, "could not get address from lease");
@@ -481,9 +481,9 @@ bound4_handle (NMDhcpSystemd *self, gboolean extended)
 {
 	NMDhcpSystemdPrivate *priv = NM_DHCP_SYSTEMD_GET_PRIVATE (self);
 	const char *iface = nm_dhcp_client_get_iface (NM_DHCP_CLIENT (self));
-	sd_dhcp_lease *lease;
 	gs_unref_object NMIP4Config *ip4_config = NULL;
 	gs_unref_hashtable GHashTable *options = NULL;
+	sd_dhcp_lease *lease = NULL;
 	GError *error = NULL;
 
 	if (   sd_dhcp_client_get_lease (priv->client4, &lease) < 0
@@ -744,7 +744,7 @@ lease_to_ip6_config (NMDedupMultiIndex *multi_idx,
 	nm_auto_free_gstring GString *str = NULL;
 	int num, i;
 
-	g_return_val_if_fail (lease, NULL);
+	nm_assert (lease);
 
 	ip6_config = nm_ip6_config_new (multi_idx, ifindex);
 
@@ -830,7 +830,7 @@ bound6_handle (NMDhcpSystemd *self)
 	gs_unref_hashtable GHashTable *options = NULL;
 	gs_free_error GError *error = NULL;
 	NMPlatformIP6Address prefix = { 0 };
-	sd_dhcp6_lease *lease;
+	sd_dhcp6_lease *lease = NULL;
 
 	if (   sd_dhcp6_client_get_lease (priv->client6, &lease) < 0
 	    || !lease) {
diff --git a/src/nm-config-data.c b/src/nm-config-data.c
index 4169a36ea4..ea3aed470b 100644
--- a/src/nm-config-data.c
+++ b/src/nm-config-data.c
@@ -1361,6 +1361,8 @@ nm_config_data_get_device_config (const NMConfigData *self,
 	const MatchSectionInfo *connection_info;
 	char *value = NULL;
 
+	NM_SET_OUT (has_match, FALSE);
+
 	g_return_val_if_fail (self, NULL);
 	g_return_val_if_fail (property && *property, NULL);
 
diff --git a/src/nm-ip4-config.c b/src/nm-ip4-config.c
index 9ad8116423..23c0d3f9d5 100644
--- a/src/nm-ip4-config.c
+++ b/src/nm-ip4-config.c
@@ -384,7 +384,7 @@ nm_ip4_config_lookup_routes (const NMIP4Config *self)
 void
 nm_ip_config_iter_ip4_route_init (NMDedupMultiIter *ipconf_iter, const NMIP4Config *self)
 {
-	g_return_if_fail (NM_IS_IP4_CONFIG (self));
+	nm_assert (NM_IS_IP4_CONFIG (self));
 	nm_dedup_multi_iter_init (ipconf_iter, nm_ip4_config_lookup_routes (self));
 }
 
diff --git a/src/settings/plugins/keyfile/nms-keyfile-reader.c b/src/settings/plugins/keyfile/nms-keyfile-reader.c
index 577709d84d..0e9ad5fa48 100644
--- a/src/settings/plugins/keyfile/nms-keyfile-reader.c
+++ b/src/settings/plugins/keyfile/nms-keyfile-reader.c
@@ -171,6 +171,7 @@ nms_keyfile_reader_from_file (const char *full_filename,
 	NM_SET_OUT (out_is_nm_generated, NM_TERNARY_DEFAULT);
 	NM_SET_OUT (out_is_volatile, NM_TERNARY_DEFAULT);
 	NM_SET_OUT (out_is_external, NM_TERNARY_DEFAULT);
+	NM_SET_OUT (out_shadowed_owned, NM_TERNARY_DEFAULT);
 
 	if (!nms_keyfile_utils_check_file_permissions (NMS_KEYFILE_FILETYPE_KEYFILE,
 	                                               full_filename,