I think that just something like this is missing:

diff --git a/modules/shepherd/service.scm b/modules/shepherd/service.scm
index 83600e4..481203d 100644
--- a/modules/shepherd/service.scm
+++ b/modules/shepherd/service.scm
@@ -728,20 +728,37 @@ false."
        ;; it for something unrelated, which can confuse some packages.
        (dup2 (open-fdes "/dev/null" O_RDONLY) 0)
 
-       (when log-file
-         (catch #t
-           (lambda ()
-             ;; Redirect stout and stderr to use LOG-FILE.
-             (catch-system-error (close-fdes 1))
-             (catch-system-error (close-fdes 2))
-             (dup2 (open-fdes log-file (logior O_CREAT O_WRONLY)) 1)
-             (dup2 (open-fdes log-file (logior O_CREAT O_WRONLY)) 2))
-           (lambda (key . args)
-             (format (current-error-port)
-                     "failed to open log-file ~s:~%" log-file)
-             (print-exception (current-error-port) #f key args)
-             (primitive-exit 1))))
-
+       (if log-file
+           (catch #t
+             (lambda ()
+               ;; Redirect stout and stderr to use LOG-FILE.
+               (catch-system-error (close-fdes 1))
+               (catch-system-error (close-fdes 2))
+               (dup2 (open-fdes log-file (logior O_CREAT O_WRONLY)) 1)
+               (dup2 (open-fdes log-file (logior O_CREAT O_WRONLY)) 2))
+             (lambda (key . args)
+               (format (current-error-port)
+                       "failed to open log-file ~s:~%" log-file)
+               (print-exception (current-error-port) #f key args)
+               (primitive-exit 1)))
+           (catch #t
+             (lambda ()
+               ;; Make sure the child has stdout/stderr that can be used.
+               ;; We sometimes set current-error-port to a softport.
+               ;; libguile would then autoconnect /dev/null -
+               ;; which we don't want.
+               ;; Also, cryptsetup interactively asks for a password,
+               ;; so we don't want /dev/kmsg either.
+               ;; In a user shepherd all this is not necessary -
+               ;; but then, port->fdes will not fail.
+               (when (not (false-if-exception (port->fdes (current-output-port))))
+                 (dup2 (open-fdes "/dev/console" (logior O_WRONLY)) 1))
+               (when (not (false-if-exception (port->fdes (current-error-port))))
+                 (dup2 (open-fdes "/dev/console" (logior O_WRONLY)) 2)))
+             (lambda (key . args)
+               (format (current-error-port) "failed to open stdout/stderr\n")
+               (print-exception (current-error-port) #f key args)
+               (primitive-exit 1))))
        (let loop ((i 3))
          (when (< i max-fd)
            ;; First try to close any ports associated with file descriptor I.

Patch starting from master attached for convenience.