diff --git a/src/bin/pg_autoctl/file_utils.c b/src/bin/pg_autoctl/file_utils.c
index 264dcd6f2..6a4f1d25f 100644
--- a/src/bin/pg_autoctl/file_utils.c
+++ b/src/bin/pg_autoctl/file_utils.c
@@ -808,8 +808,8 @@ fformat(FILE *stream, const char *fmt, ...)
 /*
  * sformat is a secured down version of pg_snprintf
  */
-int
-sformat(char *str, size_t count, const char *fmt, ...)
+bool
+sformat(char *str, size_t count, const char *result_name, const char *fmt, ...)
 {
 	int len;
 	va_list args;
@@ -817,7 +817,7 @@ sformat(char *str, size_t count, const char *fmt, ...)
 	if (str == NULL || fmt == NULL)
 	{
 		log_error("BUG: sformat is called with a NULL target or format string");
-		return -1;
+		return false;
 	}
 
 	va_start(args, fmt);
@@ -826,10 +826,11 @@ sformat(char *str, size_t count, const char *fmt, ...)
 
 	if (len >= count)
 	{
-		log_error("BUG: sformat needs %d bytes to expend format string \"%s\", "
-				  "and a target string of %lu bytes only has been given.",
-				  len, fmt, count);
+		log_error("BUG: the %s requires %d bytes to expand format string \"%s\", "
+				  "and pg_auto_failover only supports up to %lu bytes.",
+				  result_name, len, fmt, count);
+		return false;
 	}
 
-	return len;
+	return true;
 }
diff --git a/src/bin/pg_autoctl/file_utils.h b/src/bin/pg_autoctl/file_utils.h
index 6c2f00621..40032bcb4 100644
--- a/src/bin/pg_autoctl/file_utils.h
+++ b/src/bin/pg_autoctl/file_utils.h
@@ -43,7 +43,19 @@ bool normalize_filename(const char *filename, char *dst, int size);
 int fformat(FILE *stream, const char *fmt, ...)
 __attribute__((format(printf, 2, 3)));
 
-int sformat(char *str, size_t count, const char *fmt, ...)
-__attribute__((format(printf, 3, 4)));
+bool sformat(char *str, size_t count, const char *result_name, const char *fmt, ...)
+__attribute__((format(printf, 4, 5)));
+
+#define sformat_fail(str, count, result_name, fmt, ...) \
+	if (!sformat(str, count, result_name, fmt, __VA_ARGS__)) { \
+		log_debug("lineinfo for string formatting failure"); \
+		return false; \
+	}
+
+#define sformat_exit(str, count, result_name, fmt, ...) \
+	if (!sformat(str, count, result_name, fmt, __VA_ARGS__)) { \
+		log_debug("lineinfo for string formatting failure"); \
+		exit(EXIT_CODE_BAD_CONFIG); \
+	}
 
 #endif /* FILE_UTILS_H */
diff --git a/src/bin/pg_autoctl/fsm_transition.c b/src/bin/pg_autoctl/fsm_transition.c
index cb9026fc5..c384fd4b4 100644
--- a/src/bin/pg_autoctl/fsm_transition.c
+++ b/src/bin/pg_autoctl/fsm_transition.c
@@ -733,10 +733,11 @@ fsm_init_standby(Keeper *keeper)
 	replicationSource.sslOptions = config->pgSetup.ssl;
 
 	/* prepare our application_name */
-	sformat(applicationName, BUFSIZE,
-			"%s%d",
-			REPLICATION_APPLICATION_NAME_PREFIX,
-			keeper->state.current_node_id);
+	(void) sformat(applicationName, BUFSIZE,
+				   "replication application name",
+				   "%s%d",
+				   REPLICATION_APPLICATION_NAME_PREFIX,
+				   keeper->state.current_node_id);
 	replicationSource.applicationName = applicationName;
 
 	if (!standby_init_database(postgres, &replicationSource, config->nodename))
@@ -796,10 +797,11 @@ fsm_rewind_or_init(Keeper *keeper)
 	replicationSource.sslOptions = config->pgSetup.ssl;
 
 	/* prepare our application_name */
-	sformat(applicationName, BUFSIZE,
-			"%s%d",
-			REPLICATION_APPLICATION_NAME_PREFIX,
-			keeper->state.current_node_id);
+	(void) sformat(applicationName, BUFSIZE,
+				   "replication application name",
+				   "%s%d",
+				   REPLICATION_APPLICATION_NAME_PREFIX,
+				   keeper->state.current_node_id);
 	replicationSource.applicationName = applicationName;
 
 	if (!primary_rewind_to_standby(postgres, &replicationSource))
diff --git a/src/bin/pg_autoctl/ini_file.c b/src/bin/pg_autoctl/ini_file.c
index 37a1382e0..4b8fbda5f 100644
--- a/src/bin/pg_autoctl/ini_file.c
+++ b/src/bin/pg_autoctl/ini_file.c
@@ -139,11 +139,14 @@ ini_validate_options(IniOption *optionList)
 		int n;
 		char optionName[BUFSIZE];
 
-		n = sformat(optionName, BUFSIZE, "%s.%s", option->section, option->name);
+		sformat_fail(optionName, BUFSIZE, "ini option name", "%s.%s", option->section,
+					 option->name);
+		n = strlen(optionName);
 
 		if (option->optName)
 		{
-			sformat(optionName + n, BUFSIZE - n, " (--%s)", option->optName);
+			sformat_fail(optionName + n, BUFSIZE - n, "ini commandline option name",
+						 " (--%s)", option->optName);
 		}
 
 		switch (option->type)
@@ -304,8 +307,8 @@ ini_option_to_string(IniOption *option, char *dest, size_t size)
 
 		case INI_INT_T:
 		{
-			sformat(dest, size, "%d", *(option->intValue));
-			return true;
+			return sformat(dest, size, "ini stringified option", "%d",
+						   *(option->intValue));
 		}
 
 		default:
diff --git a/src/bin/pg_autoctl/ipaddr.c b/src/bin/pg_autoctl/ipaddr.c
index a4efee8ce..f5ee4bdfa 100644
--- a/src/bin/pg_autoctl/ipaddr.c
+++ b/src/bin/pg_autoctl/ipaddr.c
@@ -95,7 +95,7 @@ fetchLocalIPAddress(char *localIpAddress, int size,
 
 	if (ipAddr != NULL)
 	{
-		sformat(localIpAddress, size, "%s", buffer);
+		sformat_fail(localIpAddress, size, "local ip address", "%s", buffer);
 	}
 	else
 	{
@@ -253,7 +253,7 @@ fetchLocalCIDR(const char *localIpAddress, char *localCIDR, int size)
 		return false;
 	}
 
-	sformat(localCIDR, size, "%s/%d", network, prefix);
+	sformat_fail(localCIDR, size, "local CIDR", "%s/%d", network, prefix);
 
 	return true;
 }
@@ -585,7 +585,7 @@ findHostnameFromLocalIpAddress(char *localIpAddress, char *hostname, int size)
 			return false;
 		}
 
-		sformat(hostname, size, "%s", hbuf);
+		sformat_fail(hostname, size, "hostname", "%s", hbuf);
 
 		/* stop at the first hostname found */
 		break;
diff --git a/src/bin/pg_autoctl/keeper_config.c b/src/bin/pg_autoctl/keeper_config.c
index 5120caef1..128becc81 100644
--- a/src/bin/pg_autoctl/keeper_config.c
+++ b/src/bin/pg_autoctl/keeper_config.c
@@ -602,7 +602,11 @@ keeper_config_set_groupId_and_slot_name(KeeperConfig *config,
 	char buffer[BUFSIZE] = { 0 };
 	char *replicationSlotName = NULL;
 
-	sformat(buffer, BUFSIZE, "%s_%d", REPLICATION_SLOT_NAME_DEFAULT, nodeId);
+	if (!postgres_sprintf_replicationSlotName(nodeId, buffer, BUFSIZE))
+	{
+		/* we already logged about it */
+		return false;
+	}
 	replicationSlotName = strdup(buffer);
 
 	config->groupId = groupId;
@@ -893,7 +897,7 @@ keeper_config_set_backup_directory(KeeperConfig *config, int nodeId)
 	char absoluteBackupDirectory[PATH_MAX];
 
 	/* build the default nodename based backup directory path */
-	sformat(subdirs, MAXPGPATH, "backup/%s", config->nodename);
+	sformat_fail(subdirs, MAXPGPATH, "backup path", "backup/%s", config->nodename);
 	path_in_same_directory(pgdata, subdirs, backupDirectory);
 
 	/*
@@ -914,7 +918,7 @@ keeper_config_set_backup_directory(KeeperConfig *config, int nodeId)
 		/* we might be able to use the nodeId, better than the nodename */
 		if (nodeId > 0)
 		{
-			sformat(subdirs, MAXPGPATH, "backup/node_%d", nodeId);
+			sformat_fail(subdirs, MAXPGPATH, "backup path", "backup/node_%d", nodeId);
 			path_in_same_directory(pgdata, subdirs, backupDirectory);
 		}
 
diff --git a/src/bin/pg_autoctl/keeper_pg_init.c b/src/bin/pg_autoctl/keeper_pg_init.c
index 581f148ef..cae80b940 100644
--- a/src/bin/pg_autoctl/keeper_pg_init.c
+++ b/src/bin/pg_autoctl/keeper_pg_init.c
@@ -583,7 +583,8 @@ create_database_and_extension(Keeper *keeper)
 	log_trace("create_database_and_extension");
 
 	/* we didn't start PostgreSQL yet, also we just ran initdb */
-	sformat(hbaFilePath, MAXPGPATH, "%s/pg_hba.conf", pgSetup->pgdata);
+	sformat_fail(hbaFilePath, MAXPGPATH, "pg_hba.conf path", "%s/pg_hba.conf",
+				 pgSetup->pgdata);
 
 	/*
 	 * The Postgres URI given to the user by our facility is going to use
diff --git a/src/bin/pg_autoctl/loop.c b/src/bin/pg_autoctl/loop.c
index d3a6fa876..5ff515035 100644
--- a/src/bin/pg_autoctl/loop.c
+++ b/src/bin/pg_autoctl/loop.c
@@ -583,7 +583,7 @@ create_pidfile(const char *pidfile, pid_t pid)
 
 	log_trace("create_pidfile(%d): \"%s\"", pid, pidfile);
 
-	sformat(content, BUFSIZE, "%d", pid);
+	sformat_fail(content, BUFSIZE, "PID value", "%d", pid);
 
 	return write_file(content, strlen(content), pidfile);
 }
diff --git a/src/bin/pg_autoctl/monitor.c b/src/bin/pg_autoctl/monitor.c
index 665c2a2ac..5ca4cfb96 100644
--- a/src/bin/pg_autoctl/monitor.c
+++ b/src/bin/pg_autoctl/monitor.c
@@ -1763,7 +1763,7 @@ printLastEvents(void *ctx, PGresult *result)
 		char node[BUFSIZE];
 
 		/* for our grid alignment output it's best to have a single col here */
-		sformat(node, BUFSIZE, "%s/%s", groupId, nodeId);
+		(void) sformat(node, BUFSIZE, "groupid and nodeid", "%s/%s", groupId, nodeId);
 
 		fformat(stdout, "%30s | %10s | %6s | %18s | %18s | %s\n",
 				eventTime, formation, node,
diff --git a/src/bin/pg_autoctl/monitor_config.c b/src/bin/pg_autoctl/monitor_config.c
index 8af5763c8..8550f599f 100644
--- a/src/bin/pg_autoctl/monitor_config.c
+++ b/src/bin/pg_autoctl/monitor_config.c
@@ -475,41 +475,45 @@ monitor_config_get_postgres_uri(MonitorConfig *config, char *connectionString,
 	 * sslcrl connection parameters when using sslmode=verify-ca or
 	 * sslmode=verify-full.
 	 */
-	connStringEnd += sformat(connStringEnd,
-							 size - (connStringEnd - connectionString),
-							 "postgres://%s@%s:%d/%s",
-							 config->pgSetup.username,
-							 host,
-							 config->pgSetup.pgport,
-							 config->pgSetup.dbname);
+	sformat_fail(connStringEnd,
+				 size - (connStringEnd - connectionString),
+				 "monitor connection string",
+				 "postgres://%s@%s:%d/%s",
+				 config->pgSetup.username,
+				 host,
+				 config->pgSetup.pgport,
+				 config->pgSetup.dbname);
+	connStringEnd += strlen(connStringEnd);
 
 	if (config->pgSetup.ssl.sslMode >= SSL_MODE_PREFER)
 	{
 		char *sslmode = pgsetup_sslmode_to_string(config->pgSetup.ssl.sslMode);
 
-		connStringEnd += sformat(connStringEnd,
-								 size - (connStringEnd - connectionString),
-								 "?sslmode=%s",
-								 sslmode);
+		sformat_fail(connStringEnd,
+					 size - (connStringEnd - connectionString),
+					 "monitor sslmode option",
+					 "?sslmode=%s",
+					 sslmode);
+		connStringEnd += strlen(connStringEnd);
 
 		if (config->pgSetup.ssl.sslMode >= SSL_MODE_VERIFY_CA)
 		{
-			if (IS_EMPTY_STRING_BUFFER(config->pgSetup.ssl.crlFile))
-			{
-				connStringEnd +=
-					sformat(connStringEnd,
-							size - (connStringEnd - connectionString),
-							"&sslrootcert=%s",
-							config->pgSetup.ssl.caFile);
-			}
-			else
+			sformat_fail(connStringEnd,
+						 size - (connStringEnd - connectionString),
+						 "monitor sslrootcert option",
+						 "&sslrootcert=%s",
+						 config->pgSetup.ssl.caFile);
+			connStringEnd += strlen(connStringEnd);
+
+			if (!IS_EMPTY_STRING_BUFFER(config->pgSetup.ssl.crlFile))
 			{
-				connStringEnd +=
-					sformat(connStringEnd,
-							size - (connStringEnd - connectionString),
-							"&sslrootcert=%s&sslcrl=%s",
-							config->pgSetup.ssl.caFile,
-							config->pgSetup.ssl.crlFile);
+				sformat_fail(connStringEnd,
+							 size - (connStringEnd - connectionString),
+							 "monitor sslcrl option",
+							 "&sslrootcert=%s&sslcrl=%s",
+							 config->pgSetup.ssl.caFile,
+							 config->pgSetup.ssl.crlFile);
+				connStringEnd += strlen(connStringEnd);
 			}
 		}
 	}
diff --git a/src/bin/pg_autoctl/parsing.c b/src/bin/pg_autoctl/parsing.c
index 329c8302e..56d15c0ca 100644
--- a/src/bin/pg_autoctl/parsing.c
+++ b/src/bin/pg_autoctl/parsing.c
@@ -162,7 +162,8 @@ parse_controldata_field_uint32(const char *controlDataString,
 	char regex[BUFSIZE];
 	char *match;
 
-	sformat(regex, BUFSIZE, "^%s: *([0-9]+)$", fieldName);
+	sformat_fail(regex, BUFSIZE, "controldata uint32 parsing regex", "^%s: *([0-9]+)$",
+				 fieldName);
 	match = regexp_first_match(controlDataString, regex);
 
 	if (match == NULL)
@@ -195,7 +196,8 @@ parse_controldata_field_uint64(const char *controlDataString,
 	char regex[BUFSIZE];
 	char *match;
 
-	sformat(regex, BUFSIZE, "^%s: *([0-9]+)$", fieldName);
+	sformat_fail(regex, BUFSIZE, "controldata uint64 parsing regex", "^%s: *([0-9]+)$",
+				 fieldName);
 	match = regexp_first_match(controlDataString, regex);
 
 	if (match == NULL)
diff --git a/src/bin/pg_autoctl/pgctl.c b/src/bin/pg_autoctl/pgctl.c
index 555795354..dc07f3d97 100644
--- a/src/bin/pg_autoctl/pgctl.c
+++ b/src/bin/pg_autoctl/pgctl.c
@@ -799,7 +799,8 @@ pg_ctl_start(const char *pg_ctl,
 	int commandSize = 0;
 
 	join_path_components(logfile, pgdata, "startup.log");
-	sformat(pgport_option, sizeof(pgport_option), "\"-p %d\"", pgport);
+	sformat_fail(pgport_option, sizeof(pgport_option), "pg_ctl port option", "\"-p %d\"",
+				 pgport);
 
 	args[argsIndex++] = (char *) pg_ctl;
 	args[argsIndex++] = "--pgdata";
@@ -809,8 +810,9 @@ pg_ctl_start(const char *pg_ctl,
 
 	if (!IS_EMPTY_STRING_BUFFER(listen_addresses))
 	{
-		sformat(listen_addresses_option, sizeof(listen_addresses_option),
-				"\"-h %s\"", listen_addresses);
+		sformat_fail(listen_addresses_option, sizeof(listen_addresses_option),
+					 "pg_ctl listen adress option",
+					 "\"-h %s\"", listen_addresses);
 
 		args[argsIndex++] = "--options";
 		args[argsIndex++] = (char *) listen_addresses_option;
@@ -824,10 +826,11 @@ pg_ctl_start(const char *pg_ctl,
 			/* errors have already been logged */
 			return false;
 		}
-		sformat(option_unix_socket_directory,
-				sizeof(option_unix_socket_directory),
-				"\"-k \"%s\"\"",
-				env_pg_regress_sock_dir);
+		sformat_fail(option_unix_socket_directory,
+					 sizeof(option_unix_socket_directory),
+					 "pg_ctl unix socket directory option",
+					 "\"-k \"%s\"\"",
+					 env_pg_regress_sock_dir);
 
 		/* pg_ctl --options can be specified multiple times */
 		args[argsIndex++] = "--options";
@@ -1264,7 +1267,6 @@ prepare_primary_conninfo(char *primaryConnInfo,
 						 SSLOptions sslOptions,
 						 bool escape)
 {
-	int size = 0;
 	char escaped[BUFSIZE];
 	PQExpBuffer buffer = NULL;
 
@@ -1311,15 +1313,9 @@ prepare_primary_conninfo(char *primaryConnInfo,
 		}
 
 		/* now copy the buffer into primaryConnInfo for the caller */
-		size = sformat(primaryConnInfo, primaryConnInfoSize, "%s", escaped);
-
-		if (size == -1 || size > primaryConnInfoSize)
-		{
-			log_error("BUG: the escaped primary_conninfo requires %d bytes and "
-					  "pg_auto_failover only support up to %d bytes",
-					  size, primaryConnInfoSize);
-			return false;
-		}
+		sformat_fail(primaryConnInfo, primaryConnInfoSize, "escaped primary_conninfo",
+					 "%s",
+					 escaped);
 	}
 	else
 	{
@@ -1481,19 +1477,11 @@ pg_create_self_signed_cert(PostgresSetup *pgSetup, const char *nodename)
 		return false;
 	}
 
-	size = sformat(pgSetup->ssl.serverKey, MAXPGPATH,
-				   "%s/server.key", pgSetup->pgdata);
-
-	if (size == -1 || size > MAXPGPATH)
-	{
-		log_error("BUG: the ssl server key file path requires %d bytes and "
-				  "pg_auto_failover only support up to %d bytes",
-				  size, MAXPGPATH);
-		return false;
-	}
+	sformat_fail(pgSetup->ssl.serverKey, MAXPGPATH, "ssl server key file path",
+				 "%s/server.key", pgSetup->pgdata);
 
-	size = sformat(pgSetup->ssl.serverCert, MAXPGPATH,
-				   "%s/server.crt", pgSetup->pgdata);
+	sformat_fail(pgSetup->ssl.serverCert, MAXPGPATH, "ssl server cert file",
+				 "%s/server.crt", pgSetup->pgdata);
 
 	if (size == -1 || size > MAXPGPATH)
 	{
@@ -1503,15 +1491,7 @@ pg_create_self_signed_cert(PostgresSetup *pgSetup, const char *nodename)
 		return false;
 	}
 
-	size = sformat(subject, BUFSIZE, "/CN=%s", nodename);
-
-	if (size == -1 || size > BUFSIZE)
-	{
-		log_error("BUG: the ssl subject \"/CN=%s\" requires %d bytes and"
-				  "pg_auto_failover only support up to %d bytes",
-				  nodename, size, BUFSIZE);
-		return false;
-	}
+	sformat_fail(subject, BUFSIZE, "ssl subject", "/CN=%s", nodename);
 
 	log_info("Running %s req -new -x509 -days 365 -nodes -text "
 			 "-out %s -keyout %s -subj \"%s\"",
diff --git a/src/bin/pg_autoctl/pghba.c b/src/bin/pg_autoctl/pghba.c
index bf3f4eba7..a44847711 100644
--- a/src/bin/pg_autoctl/pghba.c
+++ b/src/bin/pg_autoctl/pghba.c
@@ -342,7 +342,8 @@ pghba_enable_lan_cidr(PGSQL *pgsql,
 	}
 	else
 	{
-		sformat(hbaFilePath, MAXPGPATH, "%s/pg_hba.conf", pgdata);
+		sformat_fail(hbaFilePath, MAXPGPATH, "pg_hba.conf path", "%s/pg_hba.conf",
+					 pgdata);
 	}
 
 	if (!pghba_ensure_host_rule_exists(hbaFilePath, ssl, databaseType, database,
diff --git a/src/bin/pg_autoctl/pgsetup.c b/src/bin/pg_autoctl/pgsetup.c
index 65a0e0a82..0f95848b6 100644
--- a/src/bin/pg_autoctl/pgsetup.c
+++ b/src/bin/pg_autoctl/pgsetup.c
@@ -645,8 +645,8 @@ pg_setup_as_json(PostgresSetup *pgSetup, JSON_Value *js)
 							  "control.catalog_version",
 							  (double) pgSetup->control.catalog_version_no);
 
-	sformat(system_identifier, BUFSIZE, "%" PRIu64,
-			pgSetup->control.system_identifier);
+	sformat_fail(system_identifier, BUFSIZE, "system identifier", "%" PRIu64,
+				 pgSetup->control.system_identifier);
 	json_object_dotset_string(jsobj,
 							  "control.system_identifier",
 							  system_identifier);
diff --git a/src/bin/pg_autoctl/pgsql.c b/src/bin/pg_autoctl/pgsql.c
index f626ca5a4..9b58fd527 100644
--- a/src/bin/pg_autoctl/pgsql.c
+++ b/src/bin/pg_autoctl/pgsql.c
@@ -386,15 +386,16 @@ pgsql_execute_with_params(PGSQL *pgsql, const char *sql, int paramCount,
 		{
 			int bytesWritten = 0;
 			const char *value = paramValues[paramIndex];
+			char *maybeComma = "";
 
 			if (paramIndex > 0)
 			{
-				bytesWritten = sformat(writePointer, remainingBytes, ", ");
-				remainingBytes -= bytesWritten;
-				writePointer += bytesWritten;
+				maybeComma = ", ";
 			}
 
-			bytesWritten = sformat(writePointer, remainingBytes, "'%s'", value);
+			sformat_fail(writePointer, remainingBytes, "command parameter", "%s'%s'",
+						 maybeComma, value);
+			bytesWritten = strlen(writePointer);
 			remainingBytes -= bytesWritten;
 			writePointer += bytesWritten;
 		}
@@ -660,10 +661,8 @@ pgsql_drop_replication_slots(PGSQL *pgsql)
 bool
 postgres_sprintf_replicationSlotName(int nodeId, char *slotName, int size)
 {
-	int bytesWritten =
-		sformat(slotName, size, "%s_%d", REPLICATION_SLOT_NAME_DEFAULT, nodeId);
-
-	return bytesWritten <= size;
+	return sformat(slotName, size, "replication_slot_name", "%s_%d",
+				   REPLICATION_SLOT_NAME_DEFAULT, nodeId);
 }
 
 
@@ -680,15 +679,8 @@ pgsql_set_synchronous_standby_names(PGSQL *pgsql,
 
 	log_info("Enabling synchronous replication");
 
-	if (sformat(quoted, BUFSIZE, "'%s'", synchronous_standby_names) >= BUFSIZE)
-	{
-		log_error("Failed to apply the synchronous_standby_names value \"%s\": "
-				  "pg_autoctl supports values up to %d bytes and this one "
-				  "requires %lu bytes",
-				  synchronous_standby_names,
-				  BUFSIZE,
-				  strlen(synchronous_standby_names));
-	}
+	sformat_fail(quoted, BUFSIZE, "synchronous_standby_names value", "'%s'",
+				 synchronous_standby_names)
 
 	return pgsql_alter_system_set(pgsql, setting);
 }
@@ -793,8 +785,8 @@ pgsql_alter_system_set(PGSQL *pgsql, GUC setting)
 {
 	char command[1024];
 
-	sformat(command, 1024,
-			"ALTER SYSTEM SET %s TO %s", setting.name, setting.value);
+	sformat_fail(command, 1024, "alter system set command",
+				 "ALTER SYSTEM SET %s TO %s", setting.name, setting.value);
 
 	if (!pgsql_execute(pgsql, command))
 	{
@@ -967,10 +959,10 @@ pgsql_create_database(PGSQL *pgsql, const char *dbname, const char *owner)
 	}
 
 	/* now build the SQL command */
-	sformat(command, BUFSIZE,
-			"CREATE DATABASE %s WITH OWNER %s",
-			escapedDBName,
-			escapedOwner);
+	sformat_fail(command, BUFSIZE, "create database command",
+				 "CREATE DATABASE %s WITH OWNER %s",
+				 escapedDBName,
+				 escapedOwner);
 
 	log_debug("Running command on Postgres: %s;", command);
 
@@ -1040,7 +1032,8 @@ pgsql_create_extension(PGSQL *pgsql, const char *name)
 	}
 
 	/* now build the SQL command */
-	sformat(command, BUFSIZE, "CREATE EXTENSION %s", escapedIdentifier);
+	sformat_fail(command, BUFSIZE, "create extension command", "CREATE EXTENSION %s",
+				 escapedIdentifier);
 	PQfreemem(escapedIdentifier);
 	log_debug("Running command on Postgres: %s;", command);
 
@@ -1547,7 +1540,7 @@ pgsql_listen(PGSQL *pgsql, char *channels[])
 			return false;
 		}
 
-		sformat(sql, BUFSIZE, "LISTEN %s", channel);
+		sformat_fail(sql, BUFSIZE, "listen command", "LISTEN %s", channel);
 
 		PQfreemem(channel);
 
@@ -1578,7 +1571,6 @@ bool
 pgsql_alter_extension_update_to(PGSQL *pgsql,
 								const char *extname, const char *version)
 {
-	int n = 0;
 	char command[BUFSIZE];
 	char *escapedIdentifier, *escapedVersion;
 	PGconn *connection = NULL;
@@ -1614,17 +1606,9 @@ pgsql_alter_extension_update_to(PGSQL *pgsql,
 	}
 
 	/* now build the SQL command */
-	n = sformat(command, BUFSIZE, "ALTER EXTENSION %s UPDATE TO %s",
-				escapedIdentifier, escapedVersion);
-
-	if (n >= BUFSIZE)
-	{
-		log_error("BUG: pg_autoctl only supports SQL string up to %d bytes, "
-				  "a SQL string of %d bytes is needed to "
-				  "update the \"%s\" extension.",
-				  BUFSIZE, n, extname);
-	}
-
+	sformat_fail(command, BUFSIZE, "update extension command",
+				 "ALTER EXTENSION %s UPDATE TO %s",
+				 escapedIdentifier, escapedVersion);
 	PQfreemem(escapedIdentifier);
 	PQfreemem(escapedVersion);
 
diff --git a/src/bin/pg_autoctl/state.c b/src/bin/pg_autoctl/state.c
index e7d4a62e9..36923fc2c 100644
--- a/src/bin/pg_autoctl/state.c
+++ b/src/bin/pg_autoctl/state.c
@@ -97,7 +97,7 @@ keeper_state_write(KeeperStateData *keeperState, const char *filename)
 	char tempFileName[MAXPGPATH];
 
 	/* we're going to write our contents to keeper.state.new first */
-	sformat(tempFileName, MAXPGPATH, "%s.new", filename);
+	sformat_fail(tempFileName, MAXPGPATH, "new state file path", "%s.new", filename);
 
 	/*
 	 * The keeper process might have been stopped in immediate shutdown mode
diff --git a/src/bin/pg_autoctl/string_utils.c b/src/bin/pg_autoctl/string_utils.c
index f3000605c..3d59e8c9c 100644
--- a/src/bin/pg_autoctl/string_utils.c
+++ b/src/bin/pg_autoctl/string_utils.c
@@ -28,7 +28,8 @@ intToString(int64_t number)
 
 	intString.intValue = number;
 
-	sformat(intString.strValue, INTSTRING_MAX_DIGITS, "%" PRId64, number);
+	(void) sformat(intString.strValue, INTSTRING_MAX_DIGITS, "integer", "%" PRId64,
+				   number);
 
 	return intString;
 }
diff --git a/src/bin/pg_autoctl/systemd_config.c b/src/bin/pg_autoctl/systemd_config.c
index 1d0306a13..63fddde7f 100644
--- a/src/bin/pg_autoctl/systemd_config.c
+++ b/src/bin/pg_autoctl/systemd_config.c
@@ -83,8 +83,8 @@ systemd_config_init(SystemdServiceConfig *config, const char *pgdata)
 	IniOption systemdOptions[] = SET_INI_OPTIONS_ARRAY(config);
 
 	/* time to setup config->pathnames.systemd */
-	sformat(config->pathnames.systemd, MAXPGPATH,
-			"/etc/systemd/system/%s", KEEPER_SYSTEMD_FILENAME);
+	sformat_exit(config->pathnames.systemd, MAXPGPATH, "systemd config path",
+				 "/etc/systemd/system/%s", KEEPER_SYSTEMD_FILENAME);
 
 	/*
 	 * In its operations pg_autoctl might remove PGDATA and replace it with a
@@ -101,12 +101,13 @@ systemd_config_init(SystemdServiceConfig *config, const char *pgdata)
 	}
 
 	/* adjust defaults to known values from the config */
-	sformat(config->EnvironmentPGDATA, BUFSIZE,
-			"'PGDATA=%s'", config->pgSetup.pgdata);
+	sformat_exit(config->EnvironmentPGDATA, BUFSIZE, "PGDATA environment variable",
+				 "'PGDATA=%s'", config->pgSetup.pgdata);
 
 	strlcpy(config->User, config->pgSetup.username, NAMEDATALEN);
 
-	sformat(config->ExecStart, BUFSIZE, "%s run", pg_autoctl_program);
+	sformat_exit(config->ExecStart, BUFSIZE, "pg_autoctl run command", "%s run",
+				 pg_autoctl_program);
 
 	if (!ini_validate_options(systemdOptions))
 	{