While typing up 2 important details I had forgotten to mention, I figured out the clue: the cryptdisks initscript never actually ran before either, and the whole thing just worked thanks to systemd-cryptsetup that got removed during the upgrade (not sure why) The 2 clues I was writing: a) now I'm wondering if before debian stable to debian testing upgrade I did, cryptsetup commands of /etc/crypttab were happening elsewhere in systemd and that /etc/init.d/cryptdisks was never actually run 2) after the upgrade, while debugging, I had these: sauron:/etc/systemd/system# l /lib/systemd/system/cryptdisks-early.service /lib/systemd/system/cryptdisks.service lrwxrwxrwx 1 root root 9 Oct 18 07:47 /lib/systemd/system/cryptdisks-early.service -> /dev/null lrwxrwxrwx 1 root root 9 Oct 18 07:47 /lib/systemd/system/cryptdisks.service -> /dev/null masking the service, and I deleted those 2 files, but now I see that they were there all along in an older backup, so it looks like /etc/init.d/cryptdisks was apparently never run as intended but somehow my disks were decrypted anyway, so I never noticed.