No LUKS password prompt on some cold boots

This has been a tough one to troubleshoot as there is no discernable pattern. For the 2nd time in a couple of weeks (new install), the prompt for my LUKS passphrases has been skipped on a cold boot. The partitions in question are only data, not the OS itself. A reboot always fixes this, thus why it’s been tricky to solve.

Nothing has changed on my system recently - GRUB, kernels were all last updated on 11/9; recent upgrades have been very scare on packages in general; no new devices have been added/subtracted from the system.

/etc/crypttab

swap                LABEL=cryptswap                                /dev/urandom  swap,offset=2048,cipher=aes-xts-plain64,size=512
dm-linux-backups    /dev/disk/by-id/wwn-0x50014ee2bca4afed-part1   none          
dm-linux-home       /dev/disk/by-id/wwn-0x5002538f33112ad6-part1   none          discard
dm-linux-vms        /dev/disk/by-id/wwn-0x5001b448b18bc74b-part1   none          discard

/etc/fstab

# <file system>             <mount point>  <type>  <options>  <dump>  <pass>
/dev/disk/by-id/wwn-0x5001b448b9036352-part1   /boot/efi         vfat    defaults,noatime 0 2
/dev/mapper/swap                               swap              swap    defaults   0 0
/dev/disk/by-id/wwn-0x5001b448b9036352-part3   /                 btrfs   subvol=/@,defaults,noatime,compress=zstd 0 0
/dev/disk/by-id/wwn-0x5001b448b9036352-part3   /.snapshots       btrfs   subvol=/@snapshots,defaults,noatime,compress=zstd 0 0
/dev/disk/by-id/wwn-0x5001b448b9036352-part3   /var/cache        btrfs   subvol=/@cache,defaults,noatime,compress=zstd 0 0
/dev/disk/by-id/wwn-0x5001b448b9036352-part3   /var/log          btrfs   subvol=/@log,defaults,noatime,compress=zstd 0 0
/dev/mapper/dm-linux-home                      /home             btrfs   subvol=/@home,defaults,noatime,compress=zstd 0 0
tmpfs                                          /tmp              tmpfs   defaults,noatime,mode=1777 0 0

# Data partitions
/dev/mapper/dm-linux-backups                   /media/backups    btrfs   subvol=/@backups,defaults,noatime,compress=zstd 0 0
/dev/mapper/dm-linux-vms                       /media/vms        ext4    defaults,noatime 0 2

# Server partitions, bind mounts
/media/vms/network-services                    /srv              none    bind 0 0

I have not made any changes to dracut, either.

In my recent searches, all I’ve found are all-or-nothing cases, nothing as partial as mine.