man: fix incorrect XML in man page

25 files changed, 217 insertions, 217 deletions

diff --git a/man/busctl.xml b/man/busctl.xml
index 8cb9a4bfa5..27327ee192 100644
--- a/man/busctl.xml
+++ b/man/busctl.xml
@@ -315,7 +315,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--json=</option><replaceable>MODE</replaceable></term>
+        <term><option>--json=<replaceable>MODE</replaceable></option></term>
 
         <listitem>
           <para>When used with the <command>call</command> or <command>get-property</command> command, shows output
@@ -341,7 +341,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--expect-reply=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--expect-reply=<replaceable>BOOL</replaceable></option></term>
 
         <listitem>
           <para>When used with the <command>call</command> command,
@@ -361,7 +361,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--auto-start=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--auto-start=<replaceable>BOOL</replaceable></option></term>
 
         <listitem>
           <para>When used with the <command>call</command> or <command>emit</command> command, specifies
@@ -375,7 +375,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--allow-interactive-authorization=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--allow-interactive-authorization=<replaceable>BOOL</replaceable></option></term>
 
         <listitem>
           <para>When used with the <command>call</command> command,
@@ -389,7 +389,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--timeout=</option><replaceable>SECS</replaceable></term>
+        <term><option>--timeout=<replaceable>SECS</replaceable></option></term>
 
         <listitem>
           <para>When used with the <command>call</command> command,
@@ -407,7 +407,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--augment-creds=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--augment-creds=<replaceable>BOOL</replaceable></option></term>
 
         <listitem>
           <para>Controls whether credential data reported by
@@ -423,7 +423,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--watch-bind=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--watch-bind=<replaceable>BOOL</replaceable></option></term>
 
         <listitem>
           <para>Controls whether to wait for the specified <constant>AF_UNIX</constant> bus socket to appear in the
@@ -435,7 +435,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--destination=</option><replaceable>SERVICE</replaceable></term>
+        <term><option>--destination=<replaceable>SERVICE</replaceable></option></term>
 
         <listitem>
           <para>Takes a service name. When used with the <command>emit</command> command, a signal is
diff --git a/man/coredumpctl.xml b/man/coredumpctl.xml
index 9e356a0da6..6179d6b760 100644
--- a/man/coredumpctl.xml
+++ b/man/coredumpctl.xml
@@ -226,7 +226,7 @@
 
       <varlistentry>
         <term><option>-F</option> <replaceable>FIELD</replaceable></term>
-        <term><option>--field=</option><replaceable>FIELD</replaceable></term>
+        <term><option>--field=<replaceable>FIELD</replaceable></option></term>
 
         <listitem><para>Print all possible data values the specified
         field takes in matching core dump entries of the
@@ -237,7 +237,7 @@
 
       <varlistentry>
         <term><option>-o</option> <replaceable>FILE</replaceable></term>
-        <term><option>--output=</option><replaceable>FILE</replaceable></term>
+        <term><option>--output=<replaceable>FILE</replaceable></option></term>
 
         <listitem><para>Write the core to <option>FILE</option>.
         </para>
@@ -246,7 +246,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--debugger=</option><replaceable>DEBUGGER</replaceable></term>
+        <term><option>--debugger=<replaceable>DEBUGGER</replaceable></option></term>
 
         <listitem><para>Use the given debugger for the <command>debug</command>
         command. If not given and <varname>$SYSTEMD_DEBUGGER</varname> is unset, then
@@ -258,7 +258,7 @@
 
       <varlistentry>
         <term><option>-A</option> <replaceable>ARGS</replaceable></term>
-        <term><option>--debugger-arguments=</option><replaceable>ARGS</replaceable></term>
+        <term><option>--debugger-arguments=<replaceable>ARGS</replaceable></option></term>
 
         <listitem><para>Pass the given <replaceable>ARGS</replaceable> as extra command line arguments
         to the debugger. Quote as appropriate when <replaceable>ARGS</replaceable> contain whitespace.
@@ -282,7 +282,7 @@
 
       <varlistentry>
         <term><option>-D</option> <replaceable>DIR</replaceable></term>
-        <term><option>--directory=</option><replaceable>DIR</replaceable></term>
+        <term><option>--directory=<replaceable>DIR</replaceable></option></term>
 
         <listitem><para>Use the journal files in the specified <option>DIR</option>.
         </para>
diff --git a/man/homectl.xml b/man/homectl.xml
index f1bade2053..effdb27f72 100644
--- a/man/homectl.xml
+++ b/man/homectl.xml
@@ -117,7 +117,7 @@
     <variablelist>
 
       <varlistentry>
-        <term><option>--identity=</option><replaceable>FILE</replaceable></term>
+        <term><option>--identity=<replaceable>FILE</replaceable></option></term>
 
         <listitem><para>Read the user's JSON record from the specified file. If passed as
         <literal>-</literal> read the user record from standard input. The supplied JSON object must follow
@@ -130,7 +130,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--json=</option><replaceable>FORMAT</replaceable></term>
+        <term><option>--json=<replaceable>FORMAT</replaceable></option></term>
         <term><option>-j</option></term>
 
         <listitem><para>Controls whether to output the user record in JSON format, if the
@@ -146,7 +146,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--export-format=</option><replaceable>FORMAT</replaceable></term>
+        <term><option>--export-format=<replaceable>FORMAT</replaceable></option></term>
         <term><option>-E</option></term>
         <term><option>-EE</option></term>
 
@@ -201,7 +201,7 @@
     <variablelist>
 
       <varlistentry>
-        <term><option>--real-name=</option><replaceable>NAME</replaceable></term>
+        <term><option>--real-name=<replaceable>NAME</replaceable></option></term>
         <term><option>-c</option> <replaceable>NAME</replaceable></term>
 
         <listitem><para>The real name for the user. This corresponds with the GECOS field on classic UNIX NSS
@@ -211,7 +211,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--realm=</option><replaceable>REALM</replaceable></term>
+        <term><option>--realm=<replaceable>REALM</replaceable></option></term>
 
         <listitem><para>The realm for the user. The realm associates a user with a specific organization or
         installation, and allows distinguishing users of the same name defined in different contexts. The
@@ -227,7 +227,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--email-address=</option><replaceable>EMAIL</replaceable></term>
+        <term><option>--email-address=<replaceable>EMAIL</replaceable></option></term>
 
         <listitem><para>Takes an electronic mail address to associate with the user. On log-in the
         <varname>$EMAIL</varname> environment variable is initialized from this value.</para>
@@ -236,7 +236,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--location=</option><replaceable>TEXT</replaceable></term>
+        <term><option>--location=<replaceable>TEXT</replaceable></option></term>
 
         <listitem><para>Takes location specification for this user. This is free-form text, which might or
         might not be usable by geo-location applications. Example: <option>--location="Berlin,
@@ -246,7 +246,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--icon-name=</option><replaceable>ICON</replaceable></term>
+        <term><option>--icon-name=<replaceable>ICON</replaceable></option></term>
 
         <listitem><para>Takes an icon name to associate with the user, following the scheme defined by the <ulink
         url="https://standards.freedesktop.org/icon-naming-spec/icon-naming-spec-latest.html">Icon Naming
@@ -256,8 +256,8 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--home-dir=</option><replaceable>PATH</replaceable></term>
-        <term><option>-d</option><replaceable>PATH</replaceable></term>
+        <term><option>--home-dir=<replaceable>PATH</replaceable></option></term>
+        <term><option>-d<replaceable>PATH</replaceable></option></term>
 
         <listitem><para>Takes a path to use as home directory for the user. Note that this is the directory
         the user's home directory is mounted to while the user is logged in. This is not where the user's
@@ -268,7 +268,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--uid=</option><replaceable>UID</replaceable></term>
+        <term><option>--uid=<replaceable>UID</replaceable></option></term>
 
         <listitem><para>Takes a preferred numeric UNIX UID to assign this user. If a user is to be created
         with the specified UID and it is already taken by a different user on the local system then creation
@@ -293,7 +293,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--member-of=</option><replaceable>GROUP</replaceable></term>
+        <term><option>--member-of=<replaceable>GROUP</replaceable></option></term>
         <term><option>-G</option> <replaceable>GROUP</replaceable></term>
 
         <listitem><para>Takes a comma-separated list of auxiliary UNIX groups this user shall belong
@@ -310,8 +310,8 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--capability-bounding-set=</option><replaceable>CAPABILITIES</replaceable></term>
-        <term><option>--capability-ambient-set=</option><replaceable>CAPABILITIES</replaceable></term>
+        <term><option>--capability-bounding-set=<replaceable>CAPABILITIES</replaceable></option></term>
+        <term><option>--capability-ambient-set=<replaceable>CAPABILITIES</replaceable></option></term>
 
         <listitem><para>These options take a space separated list of process capabilities
         (e.g. <constant>CAP_WAKE_ALARM</constant>, <constant>CAP_BLOCK_SUSPEND</constant>, …) that shall be
@@ -325,7 +325,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--skel=</option><replaceable>PATH</replaceable></term>
+        <term><option>--skel=<replaceable>PATH</replaceable></option></term>
 
         <listitem><para>Takes a file system path to a directory. Specifies the skeleton directory to
         initialize the home directory with. All files and directories in the specified path are copied into
@@ -336,7 +336,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--shell=</option><replaceable>SHELL</replaceable></term>
+        <term><option>--shell=<replaceable>SHELL</replaceable></option></term>
 
         <listitem><para>Takes a file system path. Specifies the shell binary to execute on terminal
         logins. If not specified defaults to <filename>/bin/bash</filename>.</para>
@@ -345,7 +345,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--setenv=</option><replaceable>VARIABLE</replaceable>[=<replaceable>VALUE</replaceable>]</term>
+        <term><option>--setenv=<replaceable>VARIABLE</replaceable>[=<replaceable>VALUE</replaceable>]</option></term>
 
         <listitem><para>Takes an environment variable assignment to set for all user processes. May be used
         multiple times to set multiple environment variables. When <literal>=</literal> and
@@ -360,7 +360,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--timezone=</option><replaceable>TIMEZONE</replaceable></term>
+        <term><option>--timezone=<replaceable>TIMEZONE</replaceable></option></term>
 
         <listitem><para>Takes a time zone location name that sets the timezone for the specified user. When
         the user logs in the <varname>$TZ</varname> environment variable is initialized from this
@@ -374,7 +374,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--language=</option><replaceable>LANG</replaceable></term>
+        <term><option>--language=<replaceable>LANG</replaceable></option></term>
 
         <listitem><para>Takes a comma- or colon-separated list of languages preferred by the user, ordered
         by descending priority. The <varname>$LANG</varname> and <varname>$LANGUAGE</varname> environment
@@ -386,7 +386,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--ssh-authorized-keys=</option><replaceable>KEYS</replaceable></term>
+        <term><option>--ssh-authorized-keys=<replaceable>KEYS</replaceable></option></term>
         <listitem><para>Either takes a SSH authorized key line to associate with the user record or a
         <literal>@</literal> character followed by a path to a file to read one or more such lines from. SSH
         keys configured this way are made available to SSH to permit access to this home directory and user
@@ -396,7 +396,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--pkcs11-token-uri=</option><replaceable>URI</replaceable></term>
+        <term><option>--pkcs11-token-uri=<replaceable>URI</replaceable></option></term>
         <listitem><para>Takes an RFC 7512 PKCS#11 URI referencing a security token (e.g. YubiKey or PIV
         smartcard) that shall be able to unlock the user account. The security token URI should reference a
         security token with exactly one pair of X.509 certificate and private key. A random secret key is
@@ -425,7 +425,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--fido2-credential-algorithm=</option><replaceable>STRING</replaceable></term>
+        <term><option>--fido2-credential-algorithm=<replaceable>STRING</replaceable></option></term>
         <listitem><para>Specify COSE algorithm used in credential generation. The default value is
         <literal>es256</literal>. Supported values are <literal>es256</literal>, <literal>rs256</literal>
         and <literal>eddsa</literal>.</para>
@@ -440,7 +440,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--fido2-device=</option><replaceable>PATH</replaceable></term>
+        <term><option>--fido2-device=<replaceable>PATH</replaceable></option></term>
 
         <listitem><para>Takes a path to a Linux <literal>hidraw</literal> device
         (e.g. <filename>/dev/hidraw1</filename>), referring to a FIDO2 security token implementing the
@@ -471,7 +471,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--fido2-with-client-pin=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--fido2-with-client-pin=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>When enrolling a FIDO2 security token, controls whether to require the user to enter
         a PIN when unlocking the account (the FIDO2 <literal>clientPin</literal> feature). Defaults to
@@ -483,7 +483,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--fido2-with-user-presence=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--fido2-with-user-presence=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>When enrolling a FIDO2 security token, controls whether to require the user to
         verify presence (tap the token, the FIDO2 <literal>up</literal> feature) when unlocking the account.
@@ -495,7 +495,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--fido2-with-user-verification=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--fido2-with-user-verification=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>When enrolling a FIDO2 security token, controls whether to require user verification
         when unlocking the account (the FIDO2 <literal>uv</literal> feature). Defaults to
@@ -506,7 +506,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--recovery-key=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--recovery-key=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>Accepts a boolean argument. If enabled a recovery key is configured for the
         account. A recovery key is a computer generated access key that may be used to regain access to an
@@ -518,9 +518,9 @@
       </varlistentry>
 
     <varlistentry>
-        <term><option>--blob=</option><replaceable>PATH</replaceable></term>
+        <term><option>--blob=<replaceable>PATH</replaceable></option></term>
         <term><option>-b</option> <replaceable>PATH</replaceable></term>
-        <term><option>--blob=</option><replaceable>FILENAME</replaceable>=<replaceable>PATH</replaceable></term>
+        <term><option>--blob=<replaceable>FILENAME</replaceable>=<replaceable>PATH</replaceable></option></term>
         <term><option>-b</option> <replaceable>FILENAME</replaceable>=<replaceable>PATH</replaceable></term>
 
         <listitem><para>Accepts either a directory path, or a file name followed by a file path. If just a
@@ -538,13 +538,13 @@
       </varlistentry>
 
     <varlistentry>
-        <term><option>--avatar=</option><replaceable>PATH</replaceable></term>
-        <term><option>--login-background=</option><replaceable>PATH</replaceable></term>
+        <term><option>--avatar=<replaceable>PATH</replaceable></option></term>
+        <term><option>--login-background=<replaceable>PATH</replaceable></option></term>
 
         <listitem><para>Accept a file path. If set, the specified file is used to overwrite the
         corresponding file in the user's blob directory. If blank, the corresponding file is deleted
         from the blob directory. Essentially, these options are shortcuts to
-        <option>--blob=</option><replaceable>FILENAME</replaceable>=<replaceable>PATH</replaceable>
+        <option>--blob=<replaceable>FILENAME</replaceable>=<replaceable>PATH</replaceable></option>
         for the known filenames defined in
         <ulink url="https://systemd.io/USER_RECORD_BLOB_DIRS">User Record Blob Directories</ulink>.</para>
 
@@ -552,7 +552,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--locked=</option><replaceable>BOOLEAN</replaceable></term>
+        <term><option>--locked=<replaceable>BOOLEAN</replaceable></option></term>
 
         <listitem><para>Takes a boolean argument. Specifies whether this user account shall be locked. If
         true logins into this account are prohibited, if false (the default) they are permitted (of course,
@@ -562,8 +562,8 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--not-before=</option><replaceable>TIMESTAMP</replaceable></term>
-        <term><option>--not-after=</option><replaceable>TIMESTAMP</replaceable></term>
+        <term><option>--not-before=<replaceable>TIMESTAMP</replaceable></option></term>
+        <term><option>--not-after=<replaceable>TIMESTAMP</replaceable></option></term>
 
         <listitem><para>These options take a timestamp string, in the format documented in
         <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry> and
@@ -574,8 +574,8 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--rate-limit-interval=</option><replaceable>SECS</replaceable></term>
-        <term><option>--rate-limit-burst=</option><replaceable>NUMBER</replaceable></term>
+        <term><option>--rate-limit-interval=<replaceable>SECS</replaceable></option></term>
+        <term><option>--rate-limit-burst=<replaceable>NUMBER</replaceable></option></term>
 
         <listitem><para>Configures a rate limit on authentication attempts for this user. If the user
         attempts to authenticate more often than the specified number, on a specific system, within the
@@ -586,7 +586,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--password-hint=</option><replaceable>TEXT</replaceable></term>
+        <term><option>--password-hint=<replaceable>TEXT</replaceable></option></term>
 
         <listitem><para>Takes a password hint to store alongside the user record. This string is stored
         accessible only to privileged users and the user itself and may not be queried by other users.
@@ -596,7 +596,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--enforce-password-policy=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--enforce-password-policy=<replaceable>BOOL</replaceable></option></term>
         <term><option>-P</option></term>
 
         <listitem><para>Takes a boolean argument. Configures whether to enforce the system's password policy
@@ -608,7 +608,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--password-change-now=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--password-change-now=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>Takes a boolean argument. If true the user is asked to change their password on next
         login.</para>
@@ -617,10 +617,10 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--password-change-min=</option><replaceable>TIME</replaceable></term>
-        <term><option>--password-change-max=</option><replaceable>TIME</replaceable></term>
-        <term><option>--password-change-warn=</option><replaceable>TIME</replaceable></term>
-        <term><option>--password-change-inactive=</option><replaceable>TIME</replaceable></term>
+        <term><option>--password-change-min=<replaceable>TIME</replaceable></option></term>
+        <term><option>--password-change-max=<replaceable>TIME</replaceable></option></term>
+        <term><option>--password-change-warn=<replaceable>TIME</replaceable></option></term>
+        <term><option>--password-change-inactive=<replaceable>TIME</replaceable></option></term>
 
         <listitem><para>Each of these options takes a time span specification as argument (in the syntax
         documented in
@@ -643,7 +643,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--disk-size=</option><replaceable>BYTES</replaceable></term>
+        <term><option>--disk-size=<replaceable>BYTES</replaceable></option></term>
         <listitem><para>Either takes a size in bytes as argument (possibly using the usual K, M, G, …
         suffixes for 1024 base values), a percentage value, or the special strings <literal>min</literal> or
         <literal>max</literal>, and configures the disk space to assign to the user. If a percentage value is
@@ -660,7 +660,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--access-mode=</option><replaceable>MODE</replaceable></term>
+        <term><option>--access-mode=<replaceable>MODE</replaceable></option></term>
 
         <listitem><para>Takes a UNIX file access mode written in octal. Configures the access mode of the
         home directory itself. Note that this is only used when the directory is first created, and the user
@@ -671,7 +671,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--umask=</option><replaceable>MASK</replaceable></term>
+        <term><option>--umask=<replaceable>MASK</replaceable></option></term>
 
         <listitem><para>Takes the access mode mask (in octal syntax) to apply to newly created files and
         directories of the user ("umask"). If set this controls the initial umask set for all login sessions of
@@ -681,7 +681,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--nice=</option><replaceable>NICE</replaceable></term>
+        <term><option>--nice=<replaceable>NICE</replaceable></option></term>
 
         <listitem><para>Takes the numeric scheduling priority ("nice level") to apply to the processes of the user at login
         time. Takes a numeric value in the range -20 (highest priority) to 19 (lowest priority).</para>
@@ -690,7 +690,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--rlimit=</option><replaceable>LIMIT</replaceable>=<replaceable>VALUE</replaceable><optional>:<replaceable>VALUE</replaceable></optional></term>
+        <term><option>--rlimit=<replaceable>LIMIT</replaceable>=<replaceable>VALUE</replaceable><optional>:<replaceable>VALUE</replaceable></optional></option></term>
 
         <listitem><para>Allows configuration of resource limits for processes of this user, see <citerefentry
         project='man-pages'><refentrytitle>getrlimit</refentrytitle><manvolnum>2</manvolnum></citerefentry>
@@ -703,7 +703,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--tasks-max=</option><replaceable>TASKS</replaceable></term>
+        <term><option>--tasks-max=<replaceable>TASKS</replaceable></option></term>
 
         <listitem><para>Takes a non-zero unsigned integer as argument. Configures the maximum number of tasks
         (i.e. threads, where each process is at least one thread) the user may have at any given time. This
@@ -720,8 +720,8 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--memory-high=</option><replaceable>BYTES</replaceable></term>
-        <term><option>--memory-max=</option><replaceable>BYTES</replaceable></term>
+        <term><option>--memory-high=<replaceable>BYTES</replaceable></option></term>
+        <term><option>--memory-max=<replaceable>BYTES</replaceable></option></term>
 
         <listitem><para>Set a limit on the memory a user may take up on a system at any given time in bytes
         (the usual K, M, G, … suffixes are supported, to the base of 1024). This includes all memory used by
@@ -735,8 +735,8 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--cpu-weight=</option><replaceable>WEIGHT</replaceable></term>
-        <term><option>--io-weight=</option><replaceable>WEIGHT</replaceable></term>
+        <term><option>--cpu-weight=<replaceable>WEIGHT</replaceable></option></term>
+        <term><option>--io-weight=<replaceable>WEIGHT</replaceable></option></term>
 
         <listitem><para>Set CPU and IO scheduling weights of the processes of the user, including those of
         processes forked off by the user that changed user credentials. Takes a numeric value in the range
@@ -749,7 +749,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--storage=</option><replaceable>STORAGE</replaceable></term>
+        <term><option>--storage=<replaceable>STORAGE</replaceable></option></term>
 
         <listitem><para>Selects the storage mechanism to use for this home directory. Takes one of
         <literal>luks</literal>, <literal>fscrypt</literal>, <literal>directory</literal>,
@@ -762,7 +762,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--image-path=</option><replaceable>PATH</replaceable></term>
+        <term><option>--image-path=<replaceable>PATH</replaceable></option></term>
 
         <listitem><para>Takes a file system path. Configures where to place the user's home directory. When
         LUKS2 storage is used refers to the path to the loopback file, otherwise to the path to the home
@@ -778,7 +778,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--drop-caches=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--drop-caches=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>Automatically flush OS file system caches on logout. This is useful in combination
         with the fscrypt storage backend to ensure the OS does not keep decrypted versions of the files and
@@ -791,7 +791,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--fs-type=</option><replaceable>TYPE</replaceable></term>
+        <term><option>--fs-type=<replaceable>TYPE</replaceable></option></term>
 
         <listitem><para>When LUKS2 storage is used configures the file system type to use inside the home
         directory LUKS2 container. One of <literal>btrfs</literal>, <literal>ext4</literal>,
@@ -804,7 +804,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--luks-discard=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--luks-discard=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>When LUKS2 storage is used configures whether to enable the
         <literal>discard</literal> feature of the file system. If enabled the file system on top of the LUKS2
@@ -820,7 +820,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--luks-offline-discard=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--luks-offline-discard=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>Similar to <option>--luks-discard=</option>, controls the trimming of the file
         system. However, while <option>--luks-discard=</option> controls what happens when the home directory
@@ -832,7 +832,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--luks-extra-mount-options=</option><replaceable>OPTIONS</replaceable></term>
+        <term><option>--luks-extra-mount-options=<replaceable>OPTIONS</replaceable></option></term>
 
         <listitem><para>Takes a string containing additional mount options to use when mounting the LUKS
         volume. If specified, this string will be appended to the default, built-in mount
@@ -842,16 +842,16 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--luks-cipher=</option><replaceable>CIPHER</replaceable></term>
-        <term><option>--luks-cipher-mode=</option><replaceable>MODE</replaceable></term>
-        <term><option>--luks-volume-key-size=</option><replaceable>BYTES</replaceable></term>
-        <term><option>--luks-pbkdf-type=</option><replaceable>TYPE</replaceable></term>
-        <term><option>--luks-pbkdf-hash-algorithm=</option><replaceable>ALGORITHM</replaceable></term>
-        <term><option>--luks-pbkdf-force-iterations=</option><replaceable>ITERATIONS</replaceable></term>
-        <term><option>--luks-pbkdf-time-cost=</option><replaceable>SECONDS</replaceable></term>
-        <term><option>--luks-pbkdf-memory-cost=</option><replaceable>BYTES</replaceable></term>
-        <term><option>--luks-pbkdf-parallel-threads=</option><replaceable>THREADS</replaceable></term>
-        <term><option>--luks-sector-size=</option><replaceable>BYTES</replaceable></term>
+        <term><option>--luks-cipher=<replaceable>CIPHER</replaceable></option></term>
+        <term><option>--luks-cipher-mode=<replaceable>MODE</replaceable></option></term>
+        <term><option>--luks-volume-key-size=<replaceable>BYTES</replaceable></option></term>
+        <term><option>--luks-pbkdf-type=<replaceable>TYPE</replaceable></option></term>
+        <term><option>--luks-pbkdf-hash-algorithm=<replaceable>ALGORITHM</replaceable></option></term>
+        <term><option>--luks-pbkdf-force-iterations=<replaceable>ITERATIONS</replaceable></option></term>
+        <term><option>--luks-pbkdf-time-cost=<replaceable>SECONDS</replaceable></option></term>
+        <term><option>--luks-pbkdf-memory-cost=<replaceable>BYTES</replaceable></option></term>
+        <term><option>--luks-pbkdf-parallel-threads=<replaceable>THREADS</replaceable></option></term>
+        <term><option>--luks-sector-size=<replaceable>BYTES</replaceable></option></term>
 
         <listitem><para>Configures various cryptographic parameters for the LUKS2 storage mechanism. See
         <citerefentry
@@ -909,9 +909,9 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--nosuid=</option><replaceable>BOOL</replaceable></term>
-        <term><option>--nodev=</option><replaceable>BOOL</replaceable></term>
-        <term><option>--noexec=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--nosuid=<replaceable>BOOL</replaceable></option></term>
+        <term><option>--nodev=<replaceable>BOOL</replaceable></option></term>
+        <term><option>--noexec=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>Configures the <literal>nosuid</literal>, <literal>nodev</literal> and
         <literal>noexec</literal> mount options for the home directories. By default <literal>nodev</literal>
@@ -923,10 +923,10 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--cifs-domain=</option><replaceable>DOMAIN</replaceable></term>
-        <term><option>--cifs-user-name=</option><replaceable>USER</replaceable></term>
-        <term><option>--cifs-service=</option><replaceable>SERVICE</replaceable></term>
-        <term><option>--cifs-extra-mount-options=</option><replaceable>OPTIONS</replaceable></term>
+        <term><option>--cifs-domain=<replaceable>DOMAIN</replaceable></option></term>
+        <term><option>--cifs-user-name=<replaceable>USER</replaceable></option></term>
+        <term><option>--cifs-service=<replaceable>SERVICE</replaceable></option></term>
+        <term><option>--cifs-extra-mount-options=<replaceable>OPTIONS</replaceable></option></term>
 
         <listitem><para>Configures the Windows File Sharing (CIFS) domain and user to associate with the home
         directory/user account, as well as the file share ("service") to mount as directory. The latter is
@@ -942,7 +942,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--stop-delay=</option><replaceable>SECS</replaceable></term>
+        <term><option>--stop-delay=<replaceable>SECS</replaceable></option></term>
 
         <listitem><para>Configures the time the per-user service manager shall continue to run after the all
         sessions of the user ended. The default is configured in
@@ -955,7 +955,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--kill-processes=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--kill-processes=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>Configures whether to kill all processes of the user on logout. The default is
         configured in
@@ -965,7 +965,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--auto-login=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--auto-login=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>Takes a boolean argument. Configures whether the graphical UI of the system should
         automatically log this user in if possible. Defaults to off. If less or more than one user is marked
@@ -975,7 +975,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--session-launcher=</option><replaceable>LAUNCHER</replaceable></term>
+        <term><option>--session-launcher=<replaceable>LAUNCHER</replaceable></option></term>
 
         <listitem><para>Takes a string argument. Configures the user's preferred session launcher
         .desktop entry file (i.e. <literal>gnome</literal>, <literal>plasma</literal>, or other names that
@@ -986,7 +986,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--session-type=</option><replaceable>TYPE</replaceable></term>
+        <term><option>--session-type=<replaceable>TYPE</replaceable></option></term>
 
         <listitem><para>Takes a string argument. Configures the user's preferred session type
         (i.e. <literal>x11</literal>, <literal>wayland</literal>, and other values accepted by
@@ -1070,7 +1070,7 @@
 
       <varlistentry>
         <term><command>create</command> <replaceable>USER</replaceable></term>
-        <term><command>create</command> <option>--identity=</option><replaceable>PATH</replaceable> <optional><replaceable>USER</replaceable></optional></term>
+        <term><command>create</command> <option>--identity=<replaceable>PATH</replaceable></option> <optional><replaceable>USER</replaceable></optional></term>
 
         <listitem><para>Create a new home directory/user account of the specified name. Use the various
         user record property options (as documented above) to control various aspects of the home directory
@@ -1094,7 +1094,7 @@
 
       <varlistentry>
         <term><command>update</command> <replaceable>USER</replaceable></term>
-        <term><command>update</command> <option>--identity=</option><replaceable>PATH</replaceable> <optional><replaceable>USER</replaceable></optional></term>
+        <term><command>update</command> <option>--identity=<replaceable>PATH</replaceable></option> <optional><replaceable>USER</replaceable></optional></term>
 
         <listitem><para>Update a home directory/user account. Use the various user record property options
         (as documented above) to make changes to the account, or alternatively provide a full, updated JSON
diff --git a/man/networkctl.xml b/man/networkctl.xml
index 8370e72cf9..562ca3c6a7 100644
--- a/man/networkctl.xml
+++ b/man/networkctl.xml
@@ -569,7 +569,7 @@ s - Service VLAN, m - Two-port MAC Relay (TPMR)
       </varlistentry>
 
       <varlistentry>
-        <term><option>--drop-in=</option><replaceable>NAME</replaceable></term>
+        <term><option>--drop-in=<replaceable>NAME</replaceable></option></term>
 
         <listitem>
           <para>When used with <command>edit</command>, edit the drop-in file <replaceable>NAME</replaceable>
diff --git a/man/portablectl.xml b/man/portablectl.xml
index 9651112f97..bcfaf7ced1 100644
--- a/man/portablectl.xml
+++ b/man/portablectl.xml
@@ -310,7 +310,7 @@
 
       <varlistentry>
         <term><option>-p</option> <replaceable>PROFILE</replaceable></term>
-        <term><option>--profile=</option><replaceable>PROFILE</replaceable></term>
+        <term><option>--profile=<replaceable>PROFILE</replaceable></option></term>
 
         <listitem><para>When attaching an image, select the profile to use. By default the <literal>default</literal>
         profile is used. For details about profiles, see below.</para>
@@ -392,7 +392,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--extension=</option><replaceable>PATH</replaceable></term>
+        <term><option>--extension=<replaceable>PATH</replaceable></option></term>
 
         <listitem><para>Add an additional image <replaceable>PATH</replaceable> as an overlay on
         top of <replaceable>IMAGE</replaceable> when attaching/detaching. This argument can be specified
diff --git a/man/resolvectl.xml b/man/resolvectl.xml
index afa4ca77eb..ed656b48d7 100644
--- a/man/resolvectl.xml
+++ b/man/resolvectl.xml
@@ -278,7 +278,7 @@
 
       <varlistentry>
         <term><option>-i</option> <replaceable>INTERFACE</replaceable></term>
-        <term><option>--interface=</option><replaceable>INTERFACE</replaceable></term>
+        <term><option>--interface=<replaceable>INTERFACE</replaceable></option></term>
 
         <listitem><para>Specifies the network interface to execute the query on. This may either be specified as numeric
         interface index or as network interface string (e.g. <literal>en0</literal>). Note that this option has no
@@ -290,7 +290,7 @@
 
       <varlistentry>
         <term><option>-p</option> <replaceable>PROTOCOL</replaceable></term>
-        <term><option>--protocol=</option><replaceable>PROTOCOL</replaceable></term>
+        <term><option>--protocol=<replaceable>PROTOCOL</replaceable></option></term>
 
         <listitem><para>Specifies the network protocol for the query. May be one of <literal>dns</literal>
         (i.e. classic unicast DNS), <literal>llmnr</literal> (<ulink
@@ -312,9 +312,9 @@
 
       <varlistentry>
         <term><option>-t</option> <replaceable>TYPE</replaceable></term>
-        <term><option>--type=</option><replaceable>TYPE</replaceable></term>
+        <term><option>--type=<replaceable>TYPE</replaceable></option></term>
         <term><option>-c</option> <replaceable>CLASS</replaceable></term>
-        <term><option>--class=</option><replaceable>CLASS</replaceable></term>
+        <term><option>--class=<replaceable>CLASS</replaceable></option></term>
 
         <listitem><para>When used in conjunction with the <command>query</command> command, specifies the DNS
         resource record type (e.g. <constant class='dns'>A</constant>, <constant class='dns'>AAAA</constant>,
@@ -335,7 +335,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--service-address=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--service-address=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>Takes a boolean parameter. If true (the default), when doing a service lookup with
         <option>--service</option> the hostnames contained in the <constant class='dns'>SRV</constant>
@@ -345,7 +345,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--service-txt=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--service-txt=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>Takes a boolean parameter. If true (the default), when doing a DNS-SD service lookup
         with <option>--service</option> the <constant class='dns'>TXT</constant> service metadata record is
@@ -355,7 +355,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--cname=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--cname=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>Takes a boolean parameter. If true (the default), DNS <constant
         class='dns'>CNAME</constant> or <constant class='dns'>DNAME</constant> redirections are
@@ -366,7 +366,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--validate=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--validate=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>Takes a boolean parameter; used in conjunction with <command>query</command>. If true
         (the default), DNSSEC validation is applied as usual — under the condition that it is enabled for the
@@ -380,7 +380,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--synthesize=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--synthesize=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>Takes a boolean parameter; used in conjunction with <command>query</command>. If true
         (the default), select domains are resolved on the local system, among them
@@ -395,7 +395,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--cache=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--cache=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>Takes a boolean parameter; used in conjunction with <command>query</command>. If true
         (the default), lookups use the local DNS resource record cache. If false, lookups are routed to the
@@ -405,7 +405,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--zone=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--zone=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>Takes a boolean parameter; used in conjunction with <command>query</command>. If true
         (the default), lookups are answered from locally registered LLMNR or mDNS resource records, if
@@ -416,7 +416,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--trust-anchor=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--trust-anchor=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>Takes a boolean parameter; used in conjunction with <command>query</command>. If true
         (the default), lookups for DS and DNSKEY are answered from the local DNSSEC trust anchors if
@@ -426,7 +426,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--network=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--network=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>Takes a boolean parameter; used in conjunction with <command>query</command>. If true
         (the default), lookups are answered via DNS, LLMNR or mDNS network requests if they cannot be
@@ -438,7 +438,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--search=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--search=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>Takes a boolean parameter. If true (the default), any specified single-label
         hostnames will be searched in the domains configured in the search domain list, if it is
@@ -462,7 +462,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--legend=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--legend=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>Takes a boolean parameter. If true (the default), column headers and meta information about the
         query response are shown. Otherwise, this output is suppressed.</para>
@@ -471,7 +471,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--stale-data=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--stale-data=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>Takes a boolean parameter; used in conjunction with <command>query</command>. If true
         (the default), lookups are answered with stale data (expired resource records) if
@@ -481,7 +481,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--relax-single-label=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--relax-single-label=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>Takes a boolean parameter; used in conjunction with <command>query</command>. If
         true, rules regarding routing of single-label names are relaxed. Defaults to false. By default,
diff --git a/man/standard-options.xml b/man/standard-options.xml
index aaafa98bb7..d181f90b83 100644
--- a/man/standard-options.xml
+++ b/man/standard-options.xml
@@ -36,7 +36,7 @@
   </varlistentry>
 
   <varlistentry id='legend'>
-    <term><option>--legend=</option><replaceable>BOOL</replaceable></term>
+    <term><option>--legend=<replaceable>BOOL</replaceable></option></term>
 
     <listitem>
       <para>Enable or disable printing of the legend, i.e. column headers and the footer with hints. The
@@ -73,7 +73,7 @@
   </varlistentry>
 
   <varlistentry id='json'>
-    <term><option>--json=</option><replaceable>MODE</replaceable></term>
+    <term><option>--json=<replaceable>MODE</replaceable></option></term>
 
     <listitem><para>Shows output formatted as JSON. Expects one of <literal>short</literal> (for the
     shortest possible output without any redundant whitespace or line breaks), <literal>pretty</literal>
diff --git a/man/systemctl.xml b/man/systemctl.xml
index ce560bf2e5..ca101d5b75 100644
--- a/man/systemctl.xml
+++ b/man/systemctl.xml
@@ -2418,7 +2418,7 @@ Jan 12 10:46:45 example.com bluetoothd[8900]: gatt-time-server: Input/output err
       </varlistentry>
 
       <varlistentry>
-        <term><option>--kill-value=</option><replaceable>INT</replaceable></term>
+        <term><option>--kill-value=<replaceable>INT</replaceable></option></term>
 
         <listitem><para>If used with the <command>kill</command> command, enqueues a signal along with the
         specified integer value parameter to the specified process(es). This operation is only available for
@@ -2766,7 +2766,7 @@ Jan 12 10:46:45 example.com bluetoothd[8900]: gatt-time-server: Input/output err
       </varlistentry>
 
       <varlistentry>
-        <term><option>--drop-in=</option><replaceable>NAME</replaceable></term>
+        <term><option>--drop-in=<replaceable>NAME</replaceable></option></term>
 
         <listitem><para>When used with <command>edit</command>, use <replaceable>NAME</replaceable> as the
         drop-in file name instead of <filename>override.conf</filename>.</para>
diff --git a/man/systemd-analyze.xml b/man/systemd-analyze.xml
index ca108c5cf9..9a4b0cada4 100644
--- a/man/systemd-analyze.xml
+++ b/man/systemd-analyze.xml
@@ -1056,7 +1056,7 @@ x86-64      native</programlisting>
       </varlistentry>
 
       <varlistentry>
-        <term><option>--fuzz=</option><replaceable>timespan</replaceable></term>
+        <term><option>--fuzz=<replaceable>timespan</replaceable></option></term>
 
         <listitem><para>When used in conjunction with the
         <command>critical-chain</command> command (see above), also
diff --git a/man/systemd-bsod.service.xml b/man/systemd-bsod.service.xml
index e58d64c52b..5ef10c2c07 100644
--- a/man/systemd-bsod.service.xml
+++ b/man/systemd-bsod.service.xml
@@ -58,7 +58,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--tty=</option><replaceable></replaceable></term>
+        <term><option>--tty=<replaceable></replaceable></option></term>
 
         <listitem><para>Specify the TTY to output to. By default <command>systemd-bsod</command> will
         automatically find a free VT to display the message on. If this option is specified a TTY may be
diff --git a/man/systemd-creds.xml b/man/systemd-creds.xml
index 79ede4904d..c8419d357a 100644
--- a/man/systemd-creds.xml
+++ b/man/systemd-creds.xml
@@ -283,7 +283,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--name=</option><replaceable>name</replaceable></term>
+        <term><option>--name=<replaceable>name</replaceable></option></term>
 
         <listitem><para>When specified with the <command>encrypt</command> command controls the credential
         name to embed in the encrypted credential data. If not specified the name is chosen automatically
@@ -306,7 +306,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--timestamp=</option><replaceable>timestamp</replaceable></term>
+        <term><option>--timestamp=<replaceable>timestamp</replaceable></option></term>
 
         <listitem><para>When specified with the <command>encrypt</command> command controls the timestamp to
         embed into the encrypted credential. Defaults to the current time. Takes a timestamp specification in
@@ -321,7 +321,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--not-after=</option><replaceable>timestamp</replaceable></term>
+        <term><option>--not-after=<replaceable>timestamp</replaceable></option></term>
 
         <listitem><para>When specified with the <command>encrypt</command> command controls the time when the
         credential shall not be used anymore. This embeds the specified timestamp in the encrypted
@@ -372,7 +372,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--tpm2-device=</option><replaceable>PATH</replaceable></term>
+        <term><option>--tpm2-device=<replaceable>PATH</replaceable></option></term>
 
         <listitem><para>Controls the TPM2 device to use. Expects a device node path referring to the TPM2
         chip (e.g. <filename>/dev/tpmrm0</filename>). Alternatively the special value <literal>auto</literal>
@@ -384,7 +384,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--tpm2-pcrs=</option><replaceable>PCR<optional>+PCR...</optional></replaceable></term>
+        <term><option>--tpm2-pcrs=<replaceable>PCR<optional>+PCR...</optional></replaceable></option></term>
 
         <listitem><para>Configures the TPM2 PCRs (Platform Configuration Registers) to bind the encryption
         key to. Takes a <literal>+</literal> separated list of numeric PCR indexes in the range 0…23. If not
@@ -396,8 +396,8 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--tpm2-public-key=</option><replaceable>PATH</replaceable></term>
-        <term><option>--tpm2-public-key-pcrs=</option><replaceable>PCR<optional>+PCR...</optional></replaceable></term>
+        <term><option>--tpm2-public-key=<replaceable>PATH</replaceable></option></term>
+        <term><option>--tpm2-public-key-pcrs=<replaceable>PCR<optional>+PCR...</optional></replaceable></option></term>
 
         <listitem><para>Configures a TPM2 signed PCR policy to bind encryption to, for use with the
         <command>encrypt</command> command. The <option>--tpm2-public-key=</option> option accepts a path to
@@ -419,7 +419,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--tpm2-signature=</option><replaceable>PATH</replaceable></term>
+        <term><option>--tpm2-signature=<replaceable>PATH</replaceable></option></term>
 
         <listitem><para>Takes a path to a TPM2 PCR signature file as generated by the
         <citerefentry><refentrytitle>systemd-measure</refentrytitle><manvolnum>1</manvolnum></citerefentry>
diff --git a/man/systemd-cryptenroll.xml b/man/systemd-cryptenroll.xml
index c687ac31bb..a3a2c610ee 100644
--- a/man/systemd-cryptenroll.xml
+++ b/man/systemd-cryptenroll.xml
@@ -287,7 +287,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--unlock-key-file=</option><replaceable>PATH</replaceable></term>
+        <term><option>--unlock-key-file=<replaceable>PATH</replaceable></option></term>
 
         <listitem><para>Use a file instead of a password/passphrase read from stdin to unlock the volume.
         Expects the PATH to the file containing your key to unlock the volume. Currently there is nothing like
@@ -298,7 +298,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--unlock-fido2-device=</option><replaceable>PATH</replaceable></term>
+        <term><option>--unlock-fido2-device=<replaceable>PATH</replaceable></option></term>
 
         <listitem><para>Use a FIDO2 device instead of a password/passphrase read from stdin to unlock the
         volume. Expects a <filename>hidraw</filename> device referring to the FIDO2 device (e.g.
@@ -311,7 +311,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--unlock-tpm2-device=</option><replaceable>PATH</replaceable></term>
+        <term><option>--unlock-tpm2-device=<replaceable>PATH</replaceable></option></term>
 
         <listitem><para>Use a TPM2 device instead of a password/passhprase read from stdin to unlock the
         volume. Expects a device node path referring to the TPM2 chip (e.g. <filename>/dev/tpmrm0</filename>).
@@ -323,7 +323,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--pkcs11-token-uri=</option><replaceable>URI</replaceable></term>
+        <term><option>--pkcs11-token-uri=<replaceable>URI</replaceable></option></term>
 
         <listitem><para>Enroll a PKCS#11 security token or smartcard (e.g. a YubiKey). Expects a PKCS#11 URI
         that allows to find an X.509 certificate or a public key on the token. The URI must also be suitable
@@ -356,7 +356,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--fido2-credential-algorithm=</option><replaceable>STRING</replaceable></term>
+        <term><option>--fido2-credential-algorithm=<replaceable>STRING</replaceable></option></term>
         <listitem><para>Specify COSE algorithm used in credential generation. The default value is
         <literal>es256</literal>. Supported values are <literal>es256</literal>, <literal>rs256</literal>
         and <literal>eddsa</literal>.</para>
@@ -371,7 +371,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--fido2-device=</option><replaceable>PATH</replaceable></term>
+        <term><option>--fido2-device=<replaceable>PATH</replaceable></option></term>
 
         <listitem><para>Enroll a FIDO2 security token that implements the <literal>hmac-secret</literal>
         extension (e.g. a YubiKey). Expects a <filename>hidraw</filename> device referring to the FIDO2
@@ -397,7 +397,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--fido2-with-client-pin=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--fido2-with-client-pin=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>When enrolling a FIDO2 security token, controls whether to require the user to enter
         a PIN when unlocking the volume (the FIDO2 <literal>clientPin</literal> feature). Defaults to
@@ -409,7 +409,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--fido2-with-user-presence=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--fido2-with-user-presence=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>When enrolling a FIDO2 security token, controls whether to require the user to
         verify presence (tap the token, the FIDO2 <literal>up</literal> feature) when unlocking the volume.
@@ -421,7 +421,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--fido2-with-user-verification=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--fido2-with-user-verification=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>When enrolling a FIDO2 security token, controls whether to require user verification
         when unlocking the volume (the FIDO2 <literal>uv</literal> feature). Defaults to
@@ -432,7 +432,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--tpm2-device=</option><replaceable>PATH</replaceable></term>
+        <term><option>--tpm2-device=<replaceable>PATH</replaceable></option></term>
 
         <listitem><para>Enroll a TPM2 security chip. Expects a device node path referring to the TPM2 chip
         (e.g. <filename>/dev/tpmrm0</filename>). Alternatively the special value <literal>auto</literal> may
@@ -457,7 +457,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--tpm2-device-key=</option><replaceable>PATH</replaceable></term>
+        <term><option>--tpm2-device-key=<replaceable>PATH</replaceable></option></term>
 
         <listitem><para>Enroll a TPM2 security chip using its public key. Expects a path referring to the
         TPM2 public key in TPM2B_PUBLIC format. This cannot be used with <option>--tpm2-device=</option>, as
@@ -485,7 +485,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--tpm2-seal-key-handle=</option><replaceable>HANDLE</replaceable></term>
+        <term><option>--tpm2-seal-key-handle=<replaceable>HANDLE</replaceable></option></term>
 
         <listitem><para>Configures which parent key to use for sealing, using the TPM handle (index) of the
         key. This is used to "seal" (encrypt) a secret and must be used later to "unseal" (decrypt) the
@@ -507,7 +507,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--tpm2-pcrs=</option><replaceable>PCR<optional>+PCR...</optional></replaceable></term>
+        <term><option>--tpm2-pcrs=<replaceable>PCR<optional>+PCR...</optional></replaceable></option></term>
 
         <listitem><para>Configures the TPM2 PCRs (Platform Configuration Registers) to bind to when
         enrollment is requested via <option>--tpm2-device=</option>. Takes a list of PCR entries, where each
@@ -532,7 +532,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--tpm2-with-pin=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--tpm2-with-pin=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>When enrolling a TPM2 device, controls whether to require the user to enter a PIN
         when unlocking the volume in addition to PCR binding, based on TPM2 policy authentication. Defaults
@@ -553,9 +553,9 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--tpm2-public-key=</option><replaceable>PATH</replaceable></term>
-        <term><option>--tpm2-public-key-pcrs=</option><replaceable>PCR<optional>+PCR...</optional></replaceable></term>
-        <term><option>--tpm2-signature=</option><replaceable>PATH</replaceable></term>
+        <term><option>--tpm2-public-key=<replaceable>PATH</replaceable></option></term>
+        <term><option>--tpm2-public-key-pcrs=<replaceable>PCR<optional>+PCR...</optional></replaceable></option></term>
+        <term><option>--tpm2-signature=<replaceable>PATH</replaceable></option></term>
 
         <listitem><para>Configures a TPM2 signed PCR policy to bind encryption to. The
         <option>--tpm2-public-key=</option> option accepts a path to a PEM encoded RSA public key, to bind
@@ -593,7 +593,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--tpm2-pcrlock=</option><replaceable>PATH</replaceable></term>
+        <term><option>--tpm2-pcrlock=<replaceable>PATH</replaceable></option></term>
 
         <listitem><para>Configures a TPM2 pcrlock policy to bind encryption to. Expects a path to a pcrlock
         policy file as generated by the
@@ -607,7 +607,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--wipe-slot=</option><replaceable>SLOT<optional>,SLOT...</optional></replaceable></term>
+        <term><option>--wipe-slot=<replaceable>SLOT<optional>,SLOT...</optional></replaceable></option></term>
 
         <listitem><para>Wipes one or more LUKS2 key slots. Takes a comma separated list of numeric slot
         indexes, or the special strings <literal>all</literal> (for wiping all key slots),
diff --git a/man/systemd-measure.xml b/man/systemd-measure.xml
index c979ce2f46..1707e0c7f3 100644
--- a/man/systemd-measure.xml
+++ b/man/systemd-measure.xml
@@ -194,7 +194,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--tpm2-device=</option><replaceable>PATH</replaceable></term>
+        <term><option>--tpm2-device=<replaceable>PATH</replaceable></option></term>
 
         <listitem><para>Controls which TPM2 device to use. Expects a device node path referring to the TPM2
         chip (e.g. <filename>/dev/tpmrm0</filename>). Alternatively the special value <literal>auto</literal>
@@ -206,7 +206,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--phase=</option><replaceable>PHASE</replaceable></term>
+        <term><option>--phase=<replaceable>PHASE</replaceable></option></term>
 
         <listitem><para>Controls which boot phases to calculate expected PCR 11 values for. This takes a
         series of colon-separated strings that encode boot "paths" for entering a specific phase of the boot
@@ -232,7 +232,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--append=</option><replaceable>PATH</replaceable></term>
+        <term><option>--append=<replaceable>PATH</replaceable></option></term>
 
         <listitem><para>When generating a PCR JSON signature (via the <command>sign</command> command),
         combine it with a previously generated PCR JSON signature, and output it as one. The specified path
diff --git a/man/systemd-networkd-wait-online.service.xml b/man/systemd-networkd-wait-online.service.xml
index eac903f684..e696a2ba9a 100644
--- a/man/systemd-networkd-wait-online.service.xml
+++ b/man/systemd-networkd-wait-online.service.xml
@@ -61,7 +61,7 @@
     <variablelist>
       <varlistentry>
         <term><option>-i</option> <replaceable>INTERFACE</replaceable><optional>:<replaceable>MIN_OPERSTATE</replaceable><optional>:<replaceable>MAX_OPERSTATE</replaceable></optional></optional></term>
-        <term><option>--interface=</option><replaceable>INTERFACE</replaceable><optional>:<replaceable>MIN_OPERSTATE</replaceable><optional>:<replaceable>MAX_OPERSTATE</replaceable></optional></optional></term>
+        <term><option>--interface=<replaceable>INTERFACE</replaceable><optional>:<replaceable>MIN_OPERSTATE</replaceable><optional>:<replaceable>MAX_OPERSTATE</replaceable></optional></optional></option></term>
 
         <listitem><para>Network interface to wait for before deciding if the system is online. This
         is useful when a system has several interfaces which will be configured, but a particular
@@ -80,7 +80,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--ignore=</option><replaceable>INTERFACE</replaceable></term>
+        <term><option>--ignore=<replaceable>INTERFACE</replaceable></option></term>
 
         <listitem><para>Network interfaces to be ignored when deciding
         if the system is online. By default, only the loopback
@@ -92,7 +92,7 @@
 
       <varlistentry>
         <term><option>-o</option> <replaceable>MIN_OPERSTATE</replaceable><optional>:<replaceable>MAX_OPERSTATE</replaceable></optional></term>
-        <term><option>--operational-state=</option><replaceable>MIN_OPERSTATE</replaceable><optional>:<replaceable>MAX_OPERSTATE</replaceable></optional></term>
+        <term><option>--operational-state=<replaceable>MIN_OPERSTATE</replaceable><optional>:<replaceable>MAX_OPERSTATE</replaceable></optional></option></term>
 
         <listitem><para>Takes a minimum operational state and an optional maximum operational state.
         Please see <citerefentry><refentrytitle>networkctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
@@ -158,7 +158,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--timeout=</option><replaceable>SECS</replaceable></term>
+        <term><option>--timeout=<replaceable>SECS</replaceable></option></term>
 
         <listitem><para>Fail the service if the network is not online
         by the time the timeout elapses. A timeout of 0 disables the
diff --git a/man/systemd-notify.xml b/man/systemd-notify.xml
index edbd0b9bf5..55bb8c59cf 100644
--- a/man/systemd-notify.xml
+++ b/man/systemd-notify.xml
@@ -138,7 +138,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--uid=</option><replaceable>USER</replaceable></term>
+        <term><option>--uid=<replaceable>USER</replaceable></option></term>
 
         <listitem><para>Set the user ID to send the notification from. Takes a UNIX user name or numeric UID. When
         specified the notification message will be sent with the specified UID as sender, in place of the user the
diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml
index c7359f298a..ec0492c26d 100644
--- a/man/systemd-nspawn.xml
+++ b/man/systemd-nspawn.xml
@@ -168,7 +168,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--settings=</option><replaceable>MODE</replaceable></term>
+        <term><option>--settings=<replaceable>MODE</replaceable></option></term>
 
         <listitem><para>Controls whether
         <command>systemd-nspawn</command> shall search for and use
@@ -379,7 +379,7 @@
 
       <varlistentry>
         <term><option>--volatile</option></term>
-        <term><option>--volatile=</option><replaceable>MODE</replaceable></term>
+        <term><option>--volatile=<replaceable>MODE</replaceable></option></term>
 
         <listitem><para>Boots the container in volatile mode. When no mode parameter is passed or when mode is
         specified as <option>yes</option>, full volatile mode is enabled. This means the root directory is mounted as a
@@ -1692,7 +1692,7 @@ After=sys-subsystem-net-devices-ens1.device</programlisting>
 
     <variablelist>
       <varlistentry>
-        <term><option>--console=</option><replaceable>MODE</replaceable></term>
+        <term><option>--console=<replaceable>MODE</replaceable></option></term>
 
         <listitem><para>Configures how to set up standard input, output and error output for the container
         payload, as well as the <filename>/dev/console</filename> device for the container. Takes one of
@@ -1758,8 +1758,8 @@ After=sys-subsystem-net-devices-ens1.device</programlisting>
 
       <variablelist>
         <varlistentry>
-          <term><option>--load-credential=</option><replaceable>ID</replaceable>:<replaceable>PATH</replaceable></term>
-          <term><option>--set-credential=</option><replaceable>ID</replaceable>:<replaceable>VALUE</replaceable></term>
+          <term><option>--load-credential=<replaceable>ID</replaceable>:<replaceable>PATH</replaceable></option></term>
+          <term><option>--set-credential=<replaceable>ID</replaceable>:<replaceable>VALUE</replaceable></option></term>
 
           <listitem><para>Pass a credential to the container. These two options correspond to the
           <varname>LoadCredential=</varname> and <varname>SetCredential=</varname> settings in unit files. See
diff --git a/man/systemd-pcrphase.service.xml b/man/systemd-pcrphase.service.xml
index e4ee094127..9c54663d3e 100644
--- a/man/systemd-pcrphase.service.xml
+++ b/man/systemd-pcrphase.service.xml
@@ -158,7 +158,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--tpm2-device=</option><replaceable>PATH</replaceable></term>
+        <term><option>--tpm2-device=<replaceable>PATH</replaceable></option></term>
 
         <listitem><para>Controls which TPM2 device to use. Expects a device node path referring to the TPM2
         chip (e.g. <filename>/dev/tpmrm0</filename>). Alternatively the special value <literal>auto</literal>
diff --git a/man/systemd-repart.xml b/man/systemd-repart.xml
index e719bd9687..8f48081097 100644
--- a/man/systemd-repart.xml
+++ b/man/systemd-repart.xml
@@ -390,8 +390,8 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--tpm2-device-key=</option><replaceable>PATH</replaceable></term>
-        <term><option>--tpm2-seal-key-handle=</option><replaceable>HANDLE</replaceable></term>
+        <term><option>--tpm2-device-key=<replaceable>PATH</replaceable></option></term>
+        <term><option>--tpm2-seal-key-handle=<replaceable>HANDLE</replaceable></option></term>
 
         <listitem><para>Configures a TPM2 SRK key to bind encryption to. See
         <citerefentry><refentrytitle>systemd-cryptenroll</refentrytitle><manvolnum>1</manvolnum></citerefentry>
@@ -401,8 +401,8 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--tpm2-public-key=</option><replaceable>PATH</replaceable></term>
-        <term><option>--tpm2-public-key-pcrs=</option><replaceable>PCR<optional>+PCR...</optional></replaceable></term>
+        <term><option>--tpm2-public-key=<replaceable>PATH</replaceable></option></term>
+        <term><option>--tpm2-public-key-pcrs=<replaceable>PCR<optional>+PCR...</optional></replaceable></option></term>
 
         <listitem><para>Configures a TPM2 signed PCR policy to bind encryption to. See
         <citerefentry><refentrytitle>systemd-cryptenroll</refentrytitle><manvolnum>1</manvolnum></citerefentry>
@@ -412,7 +412,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--tpm2-pcrlock=</option><replaceable>PATH</replaceable></term>
+        <term><option>--tpm2-pcrlock=<replaceable>PATH</replaceable></option></term>
 
         <listitem><para>Configures a TPM2 pcrlock policy to bind encryption to. See
         <citerefentry><refentrytitle>systemd-cryptenroll</refentrytitle><manvolnum>1</manvolnum></citerefentry>
@@ -422,7 +422,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--split=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--split=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>Enables generation of split artifacts from partitions configured with
         <varname>SplitName=</varname>. If enabled, for each partition with <varname>SplitName=</varname> set,
@@ -439,8 +439,8 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--include-partitions=</option><replaceable>PARTITIONS</replaceable></term>
-        <term><option>--exclude-partitions=</option><replaceable>PARTITIONS</replaceable></term>
+        <term><option>--include-partitions=<replaceable>PARTITIONS</replaceable></option></term>
+        <term><option>--exclude-partitions=<replaceable>PARTITIONS</replaceable></option></term>
 
         <listitem><para>These options specify which partition types <command>systemd-repart</command> should
         operate on. If <option>--include-partitions=</option> is used, all partitions that aren't specified
@@ -454,7 +454,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--defer-partitions=</option><replaceable>PARTITIONS</replaceable></term>
+        <term><option>--defer-partitions=<replaceable>PARTITIONS</replaceable></option></term>
 
         <listitem><para>This option specifies for which partition types <command>systemd-repart</command>
         should defer. All partitions that are deferred using this option are still taken into account when
@@ -467,7 +467,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--sector-size=</option><replaceable>BYTES</replaceable></term>
+        <term><option>--sector-size=<replaceable>BYTES</replaceable></option></term>
 
         <listitem><para>This option allows configuring the sector size of the image produced by
         <command>systemd-repart</command>. It takes a value that is a power of <literal>2</literal> between
@@ -478,7 +478,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--architecture=</option><replaceable>ARCH</replaceable></term>
+        <term><option>--architecture=<replaceable>ARCH</replaceable></option></term>
 
         <listitem><para>This option allows overriding the architecture used for architecture specific
         partition types. For example, if set to <literal>arm64</literal> a partition type of
@@ -508,7 +508,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--offline=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--offline=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>Instructs <command>systemd-repart</command> to build the image offline. Takes a
         boolean or <literal>auto</literal>. Defaults to <literal>auto</literal>. If enabled, the image is
@@ -522,7 +522,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--copy-from=</option><replaceable>IMAGE</replaceable></term>
+        <term><option>--copy-from=<replaceable>IMAGE</replaceable></option></term>
 
         <listitem><para>Instructs <command>systemd-repart</command> to synthesize partition definitions from
         the partition table in the given image. This option can be specified multiple times to synthesize
@@ -537,7 +537,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--copy-source=</option><replaceable>PATH</replaceable></term>
+        <term><option>--copy-source=<replaceable>PATH</replaceable></option></term>
         <term><option>-s</option> <replaceable>PATH</replaceable></term>
 
         <listitem><para>Specifies a source directory all <varname>CopyFiles=</varname> source paths shall be
@@ -550,7 +550,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--make-ddi=</option><replaceable>TYPE</replaceable></term>
+        <term><option>--make-ddi=<replaceable>TYPE</replaceable></option></term>
 
         <listitem><para>Takes one of <literal>sysext</literal>, <literal>confext</literal> or
         <literal>portable</literal>. Generates a Discoverable Disk Image (DDI) for a system extension
@@ -591,7 +591,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--generate-fstab=</option><replaceable>PATH</replaceable></term>
+        <term><option>--generate-fstab=<replaceable>PATH</replaceable></option></term>
 
         <listitem><para>Specifies a path where to write fstab entries for the mountpoints configured with
         <option>MountPoint=</option> in the root directory specified with <option>--copy-source=</option> or
@@ -602,7 +602,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--generate-crypttab=</option><replaceable>PATH</replaceable></term>
+        <term><option>--generate-crypttab=<replaceable>PATH</replaceable></option></term>
 
         <listitem><para>Specifies a path where to write crypttab entries for the encrypted volumes configured
         with <option>EncryptedVolume=</option> in the root directory specified with
diff --git a/man/systemd-socket-activate.xml b/man/systemd-socket-activate.xml
index 4d0a581c00..4c29fa2c66 100644
--- a/man/systemd-socket-activate.xml
+++ b/man/systemd-socket-activate.xml
@@ -122,7 +122,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--fdname=</option><replaceable>NAME</replaceable><optional>:<replaceable>NAME</replaceable>…</optional></term>
+        <term><option>--fdname=<replaceable>NAME</replaceable><optional>:<replaceable>NAME</replaceable>…</optional></option></term>
 
         <listitem><para>Specify names for the file descriptors passed. This is equivalent to setting
         <varname>FileDescriptorName=</varname> in socket unit files, and enables use of
diff --git a/man/systemd-sysext.xml b/man/systemd-sysext.xml
index 5a6dffd2c5..de032f48cb 100644
--- a/man/systemd-sysext.xml
+++ b/man/systemd-sysext.xml
@@ -380,7 +380,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--mutable=</option><replaceable>BOOL</replaceable>|<replaceable>auto</replaceable>|<replaceable>import</replaceable></term>
+        <term><option>--mutable=<replaceable>BOOL</replaceable>|<replaceable>auto</replaceable>|<replaceable>import</replaceable></option></term>
         <listitem><para>Set mutable mode.</para>
 
         <variablelist>
@@ -435,7 +435,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--noexec=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--noexec=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>When merging configuration extensions into <filename>/etc/</filename> the
         <literal>MS_NOEXEC</literal> mount flag is used by default. This option can be used to disable
diff --git a/man/systemd-vmspawn.xml b/man/systemd-vmspawn.xml
index 755040c1cb..f9649b2f30 100644
--- a/man/systemd-vmspawn.xml
+++ b/man/systemd-vmspawn.xml
@@ -104,7 +104,7 @@
 
       <variablelist>
         <varlistentry>
-          <term><option>--cpus=</option><replaceable>CPUS</replaceable></term>
+          <term><option>--cpus=<replaceable>CPUS</replaceable></option></term>
 
           <listitem><para>Configures the number of CPUs to start the virtual machine with.
           Defaults to 1.</para>
@@ -114,7 +114,7 @@
         </varlistentry>
 
         <varlistentry>
-          <term><option>--ram=</option><replaceable>BYTES</replaceable></term>
+          <term><option>--ram=<replaceable>BYTES</replaceable></option></term>
 
           <listitem><para>Configures the amount of memory to start the virtual machine with.
           Defaults to 2G.</para>
@@ -124,7 +124,7 @@
         </varlistentry>
 
         <varlistentry>
-          <term><option>--kvm=</option><replaceable>BOOL</replaceable></term>
+          <term><option>--kvm=<replaceable>BOOL</replaceable></option></term>
 
           <listitem><para>Configures whether to use KVM. If the option is not specified KVM support will be
           detected automatically. If true, KVM is always used, and if false, KVM is never used.</para>
@@ -133,7 +133,7 @@
         </varlistentry>
 
         <varlistentry>
-          <term><option>--vsock=</option><replaceable>BOOL</replaceable></term>
+          <term><option>--vsock=<replaceable>BOOL</replaceable></option></term>
 
           <listitem>
             <para>Configure whether to use VSOCK networking.</para>
@@ -145,7 +145,7 @@
         </varlistentry>
 
         <varlistentry>
-          <term><option>--vsock-cid=</option><replaceable>CID</replaceable></term>
+          <term><option>--vsock-cid=<replaceable>CID</replaceable></option></term>
 
           <listitem>
             <para>Configure vmspawn to use a specific CID for the guest.</para>
@@ -160,7 +160,7 @@
         </varlistentry>
 
         <varlistentry>
-          <term><option>--tpm=</option><replaceable>BOOL</replaceable></term>
+          <term><option>--tpm=<replaceable>BOOL</replaceable></option></term>
 
           <listitem>
             <para>Configure whether to use VM with a virtual TPM or not.</para>
@@ -178,7 +178,7 @@
         </varlistentry>
 
         <varlistentry>
-          <term><option>--linux=</option><replaceable>PATH</replaceable></term>
+          <term><option>--linux=<replaceable>PATH</replaceable></option></term>
 
           <listitem>
             <para>Set the linux kernel image to use for direct kernel boot.</para>
@@ -190,7 +190,7 @@
         </varlistentry>
 
         <varlistentry>
-          <term><option>--initrd=</option><replaceable>PATH</replaceable></term>
+          <term><option>--initrd=<replaceable>PATH</replaceable></option></term>
 
           <listitem>
             <para>Set the initrd to use for direct kernel boot.</para>
@@ -233,7 +233,7 @@
         </varlistentry>
 
         <varlistentry>
-          <term><option>--firmware=</option><replaceable>PATH</replaceable></term>
+          <term><option>--firmware=<replaceable>PATH</replaceable></option></term>
 
           <listitem><para>Takes an absolute path, or a relative path beginning with
           <filename>./</filename>. Specifies a JSON firmware definition file, which allows selecting the
@@ -254,7 +254,7 @@
         </varlistentry>
 
         <varlistentry>
-          <term><option>--secure-boot=</option><replaceable>BOOL</replaceable></term>
+          <term><option>--secure-boot=<replaceable>BOOL</replaceable></option></term>
 
           <listitem><para>Configure whether to search for firmware which supports Secure Boot.</para>
 
@@ -327,7 +327,7 @@
 
       <variablelist>
         <varlistentry>
-          <term><option>--private-users=</option><replaceable>UID_SHIFT[:UID_RANGE]</replaceable></term>
+          <term><option>--private-users=<replaceable>UID_SHIFT[:UID_RANGE]</replaceable></option></term>
 
           <listitem><para>Controls user namespacing under <option>--directory=</option>.
           If enabled, <command>virtiofsd</command> is instructed to map user and group ids (UIDs and GIDs).
@@ -353,8 +353,8 @@
       <variablelist>
 
         <varlistentry>
-          <term><option>--bind=</option><replaceable>PATH</replaceable></term>
-          <term><option>--bind-ro=</option><replaceable>PATH</replaceable></term>
+          <term><option>--bind=<replaceable>PATH</replaceable></option></term>
+          <term><option>--bind-ro=<replaceable>PATH</replaceable></option></term>
 
           <listitem><para>Mount a directory from the host into the virtual machine. Takes one of: a path
           argument — in which case the specified path will be mounted from the host to the same path in the virtual machine, or
@@ -368,7 +368,7 @@
         </varlistentry>
 
         <varlistentry>
-          <term><option>--extra-drive=</option><replaceable>PATH</replaceable></term>
+          <term><option>--extra-drive=<replaceable>PATH</replaceable></option></term>
 
           <listitem><para>Takes a disk image or block device on the host and supplies it to the virtual machine as another drive.</para>
 
@@ -383,7 +383,7 @@
 
       <variablelist>
         <varlistentry>
-          <term><option>--forward-journal=</option><replaceable>FILE|DIR</replaceable></term>
+          <term><option>--forward-journal=<replaceable>FILE|DIR</replaceable></option></term>
 
           <listitem><para>Forward the virtual machine's journal to the host.
           <citerefentry><refentrytitle>systemd-journal-remote</refentrytitle><manvolnum>8</manvolnum></citerefentry>
@@ -397,7 +397,7 @@
         </varlistentry>
 
         <varlistentry>
-          <term><option>--pass-ssh-key=</option><replaceable>BOOL</replaceable></term>
+          <term><option>--pass-ssh-key=<replaceable>BOOL</replaceable></option></term>
 
           <listitem><para>By default an SSH key is generated to allow <command>systemd-vmspawn</command> to open
           a D-Bus connection to the VM's systemd bus. Setting this to "no" will disable SSH key generation.</para>
@@ -410,7 +410,7 @@
         </varlistentry>
 
         <varlistentry>
-          <term><option>--ssh-key-type=</option><replaceable>TYPE</replaceable></term>
+          <term><option>--ssh-key-type=<replaceable>TYPE</replaceable></option></term>
 
           <listitem><para>Configures the type of SSH key to generate, see
           <citerefentry project="man-pages"><refentrytitle>ssh-keygen</refentrytitle><manvolnum>1</manvolnum></citerefentry>
@@ -430,7 +430,7 @@
 
       <variablelist>
         <varlistentry>
-          <term><option>--console=</option><replaceable>MODE</replaceable></term>
+          <term><option>--console=<replaceable>MODE</replaceable></option></term>
 
           <listitem><para>Configures how to set up the console of the VM. Takes one of
           <literal>interactive</literal>, <literal>read-only</literal>, <literal>native</literal>,
@@ -466,8 +466,8 @@
 
       <variablelist>
         <varlistentry>
-          <term><option>--load-credential=</option><replaceable>ID</replaceable>:<replaceable>PATH</replaceable></term>
-          <term><option>--set-credential=</option><replaceable>ID</replaceable>:<replaceable>VALUE</replaceable></term>
+          <term><option>--load-credential=<replaceable>ID</replaceable>:<replaceable>PATH</replaceable></option></term>
+          <term><option>--set-credential=<replaceable>ID</replaceable>:<replaceable>VALUE</replaceable></option></term>
 
           <listitem><para>Pass a credential to the virtual machine. These two options correspond to the
           <varname>LoadCredential=</varname> and <varname>SetCredential=</varname> settings in unit files. See
diff --git a/man/systemd.xml b/man/systemd.xml
index cb798af34c..abfcc499f0 100644
--- a/man/systemd.xml
+++ b/man/systemd.xml
@@ -1360,7 +1360,7 @@
         </varlistentry>
 
         <varlistentry>
-          <term><option>--crash-vt=</option><replaceable>VT</replaceable></term>
+          <term><option>--crash-vt=<replaceable>VT</replaceable></option></term>
 
           <listitem><para>Switch to a specific virtual console (VT) on crash. This switch has no effect when
           running as user instance. Same as <varname>systemd.crash_chvt=</varname> above (but not the
diff --git a/man/udevadm.xml b/man/udevadm.xml
index 643321b0a2..41c8ae7a12 100644
--- a/man/udevadm.xml
+++ b/man/udevadm.xml
@@ -704,7 +704,7 @@
         </varlistentry>
         <varlistentry>
           <term><option>-m</option></term>
-          <term><option>--children-max=</option><replaceable>value</replaceable></term>
+          <term><option>--children-max=<replaceable>value</replaceable></option></term>
           <listitem>
             <para>Set the maximum number of events, systemd-udevd will handle at the same time. When 0 is
             specified, then the maximum is determined based on the system resources.</para>
@@ -721,7 +721,7 @@
         </varlistentry>
         <varlistentry>
           <term><option>-t</option></term>
-          <term><option>--timeout=</option><replaceable>seconds</replaceable></term>
+          <term><option>--timeout=<replaceable>seconds</replaceable></option></term>
           <listitem>
             <para>The maximum number of seconds to wait for a reply from systemd-udevd.</para>
           </listitem>
diff --git a/man/userdbctl.xml b/man/userdbctl.xml
index 479893217f..a7b438ad91 100644
--- a/man/userdbctl.xml
+++ b/man/userdbctl.xml
@@ -53,7 +53,7 @@
     <variablelist>
 
       <varlistentry>
-        <term><option>--output=</option><replaceable>MODE</replaceable></term>
+        <term><option>--output=<replaceable>MODE</replaceable></option></term>
 
         <listitem><para>Choose the output mode, takes one of <literal>classic</literal>,
         <literal>friendly</literal>, <literal>table</literal>, <literal>json</literal>. If
@@ -74,7 +74,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--json=</option><replaceable>FORMAT</replaceable></term>
+        <term><option>--json=<replaceable>FORMAT</replaceable></option></term>
 
         <listitem><para>Selects JSON output mode (like <option>--output=json</option>) and selects the
         precise display mode. Takes one of <literal>pretty</literal> or <literal>short</literal>. If
@@ -86,7 +86,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--service=</option><replaceable>SERVICE</replaceable><optional>:<replaceable>SERVICE…</replaceable></optional></term>
+        <term><option>--service=<replaceable>SERVICE</replaceable><optional>:<replaceable>SERVICE…</replaceable></optional></option></term>
         <term><option>-s</option> <replaceable>SERVICE</replaceable>:<replaceable>SERVICE…</replaceable></term>
 
         <listitem><para>Controls which services to query for users/groups. Takes a list of one or more
@@ -97,7 +97,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--with-nss=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--with-nss=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>Controls whether to include classic glibc/NSS user/group lookups in the output. If
         <option>--with-nss=no</option> is used any attempts to resolve or enumerate users/groups provided
@@ -108,7 +108,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--with-varlink=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--with-varlink=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>Controls whether to include Varlink user/group lookups in the output, i.e. those done
         via the <ulink url="https://systemd.io/USER_GROUP_API">User/Group Record Lookup API via
@@ -120,7 +120,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--with-dropin=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--with-dropin=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>Controls whether to include user/group lookups in the output that are defined using
         drop-in files in <filename>/etc/userdb/</filename>, <filename>/run/userdb/</filename>,
@@ -133,7 +133,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--synthesize=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--synthesize=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>Controls whether to synthesize records for the root and nobody users/groups if they
         aren't defined otherwise. By default (or <literal>yes</literal>) such records are implicitly
@@ -155,7 +155,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--multiplexer=</option><replaceable>BOOL</replaceable></term>
+        <term><option>--multiplexer=<replaceable>BOOL</replaceable></option></term>
 
         <listitem><para>Controls whether to do lookups via the multiplexer service (if specified as true, the
         default) or do lookups in the client (if specified as false). Using the multiplexer service is
diff --git a/man/varlinkctl.xml b/man/varlinkctl.xml
index 22add03a9d..eefc3d1de0 100644
--- a/man/varlinkctl.xml
+++ b/man/varlinkctl.xml
@@ -204,7 +204,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--json=</option><replaceable>MODE</replaceable></term>
+        <term><option>--json=<replaceable>MODE</replaceable></option></term>
 
         <listitem>
           <para>Selects the JSON output formatting, one of <literal>pretty</literal> (for nicely indented,