diff --git a/src/libsystemd/libsystemd.sym b/src/libsystemd/libsystemd.sym
index 24dfee7095..fb6e6f6431 100644
--- a/src/libsystemd/libsystemd.sym
+++ b/src/libsystemd/libsystemd.sym
@@ -818,6 +818,7 @@ global:
         sd_netlink_message_append_s32;
         sd_netlink_message_append_s64;
         sd_netlink_message_append_data;
+        sd_netlink_message_append_container_data;
         sd_netlink_message_append_in_addr;
         sd_netlink_message_append_in6_addr;
         sd_netlink_message_append_sockaddr_in;
diff --git a/src/libsystemd/sd-netlink/netlink-message-nfnl.c b/src/libsystemd/sd-netlink/netlink-message-nfnl.c
index e70cf52631..ed83a61804 100644
--- a/src/libsystemd/sd-netlink/netlink-message-nfnl.c
+++ b/src/libsystemd/sd-netlink/netlink-message-nfnl.c
@@ -290,20 +290,6 @@ int sd_nfnl_nft_message_del_setelems_begin(
         return r;
 }
 
-static int add_data(sd_netlink_message *m, uint16_t attr, const void *data, uint32_t dlen) {
-        int r;
-
-        r = sd_netlink_message_open_container(m, attr);
-        if (r < 0)
-                return r;
-
-        r = sd_netlink_message_append_data(m, NFTA_DATA_VALUE, data, dlen);
-        if (r < 0)
-                return r;
-
-        return sd_netlink_message_close_container(m); /* attr */
-}
-
 int sd_nfnl_nft_message_add_setelem(
                 sd_netlink_message *m,
                 uint32_t index,
@@ -318,12 +304,12 @@ int sd_nfnl_nft_message_add_setelem(
         if (r < 0)
                 return r;
 
-        r = add_data(m, NFTA_SET_ELEM_KEY, key, key_len);
+        r = sd_netlink_message_append_container_data(m, NFTA_SET_ELEM_KEY, NFTA_DATA_VALUE, key, key_len);
         if (r < 0)
                 goto cancel;
 
         if (data) {
-                r = add_data(m, NFTA_SET_ELEM_DATA, data, data_len);
+                r = sd_netlink_message_append_container_data(m, NFTA_SET_ELEM_DATA, NFTA_DATA_VALUE, data, data_len);
                 if (r < 0)
                         goto cancel;
         }
diff --git a/src/libsystemd/sd-netlink/netlink-message.c b/src/libsystemd/sd-netlink/netlink-message.c
index 34b4c23bd5..192feac47d 100644
--- a/src/libsystemd/sd-netlink/netlink-message.c
+++ b/src/libsystemd/sd-netlink/netlink-message.c
@@ -452,6 +452,29 @@ _public_ int sd_netlink_message_append_data(sd_netlink_message *m, unsigned shor
         return 0;
 }
 
+_public_ int sd_netlink_message_append_container_data(
+                sd_netlink_message *m,
+                unsigned short container_type,
+                unsigned short type,
+                const void *data,
+                size_t len) {
+
+        int r;
+
+        assert_return(m, -EINVAL);
+        assert_return(!m->sealed, -EPERM);
+
+        r = sd_netlink_message_open_container(m, container_type);
+        if (r < 0)
+                return r;
+
+        r = sd_netlink_message_append_data(m, type, data, len);
+        if (r < 0)
+                return r;
+
+        return sd_netlink_message_close_container(m);
+}
+
 int netlink_message_append_in_addr_union(sd_netlink_message *m, unsigned short type, int family, const union in_addr_union *data) {
         int r;
 
diff --git a/src/shared/firewall-util-nft.c b/src/shared/firewall-util-nft.c
index 0a8fc08f99..66ea8ee0bd 100644
--- a/src/shared/firewall-util-nft.c
+++ b/src/shared/firewall-util-nft.c
@@ -254,28 +254,6 @@ static int nfnl_add_expr_lookup_map(
         return sd_netlink_message_close_container(m); /* NFTA_LIST_ELEM */
 }
 
-static int nfnl_add_expr_data(
-                sd_netlink_message *m,
-                int attr,
-                const void *data,
-                uint32_t dlen) {
-
-        int r;
-
-        assert(m);
-        assert(data);
-
-        r = sd_netlink_message_open_container(m, attr);
-        if (r < 0)
-                return r;
-
-        r = sd_netlink_message_append_data(m, NFTA_DATA_VALUE, data, dlen);
-        if (r < 0)
-                return r;
-
-        return sd_netlink_message_close_container(m); /* attr */
-}
-
 static int nfnl_add_expr_cmp(
                 sd_netlink_message *m,
                 enum nft_cmp_ops cmp_op,
@@ -300,7 +278,7 @@ static int nfnl_add_expr_cmp(
         if (r < 0)
                 return r;
 
-        r = nfnl_add_expr_data(m, NFTA_CMP_DATA, data, dlen);
+        r = sd_netlink_message_append_container_data(m, NFTA_CMP_DATA, NFTA_DATA_VALUE, data, dlen);
         if (r < 0)
                 return r;
 
@@ -341,11 +319,11 @@ static int nfnl_add_expr_bitwise(
         if (r < 0)
                 return r;
 
-        r = nfnl_add_expr_data(m, NFTA_BITWISE_MASK, and, len);
+        r = sd_netlink_message_append_container_data(m, NFTA_BITWISE_MASK, NFTA_DATA_VALUE, and, len);
         if (r < 0)
                 return r;
 
-        r = nfnl_add_expr_data(m, NFTA_BITWISE_XOR, xor, len);
+        r = sd_netlink_message_append_container_data(m, NFTA_BITWISE_XOR, NFTA_DATA_VALUE, xor, len);
         if (r < 0)
                 return r;
 
diff --git a/src/systemd/sd-netlink.h b/src/systemd/sd-netlink.h
index dcdf77c4fe..541eb1110a 100644
--- a/src/systemd/sd-netlink.h
+++ b/src/systemd/sd-netlink.h
@@ -83,6 +83,12 @@ int sd_netlink_message_append_s16(sd_netlink_message *m, unsigned short type, in
 int sd_netlink_message_append_s32(sd_netlink_message *m, unsigned short type, int32_t data);
 int sd_netlink_message_append_s64(sd_netlink_message *m, unsigned short type, int64_t data);
 int sd_netlink_message_append_data(sd_netlink_message *m, unsigned short type, const void *data, size_t len);
+int sd_netlink_message_append_container_data(
+                sd_netlink_message *m,
+                unsigned short container_type,
+                unsigned short type,
+                const void *data,
+                size_t len);
 int sd_netlink_message_append_in_addr(sd_netlink_message *m, unsigned short type, const struct in_addr *data);
 int sd_netlink_message_append_in6_addr(sd_netlink_message *m, unsigned short type, const struct in6_addr *data);
 int sd_netlink_message_append_sockaddr_in(sd_netlink_message *m, unsigned short type, const struct sockaddr_in *data);