diff --git a/mkosi/mkosi.credentials/userdb.user.testuser b/mkosi/mkosi.credentials/userdb.user.testuser
index 6a2ce88324..69a1bfd21d 100644
--- a/mkosi/mkosi.credentials/userdb.user.testuser
+++ b/mkosi/mkosi.credentials/userdb.user.testuser
@@ -3,10 +3,6 @@
     "uid": 4711,
     "disposition": "regular",
     "enforcePasswordPolicy": false,
-    "memberOf": [
-        "wheel",
-        "systemd-journal"
-    ],
     "shell": "/bin/bash",
     "privileged": {
         "hashedPassword": ["$1$kqp7NF1f$tNnQcshPX53CSfRKTQD0R1"]
diff --git a/src/userdb/userdbctl.c b/src/userdb/userdbctl.c
index 8efdc7c133..ca698e7345 100644
--- a/src/userdb/userdbctl.c
+++ b/src/userdb/userdbctl.c
@@ -1430,7 +1430,7 @@ static int load_credential_one(
 
         if (ur)
                 STRV_FOREACH(g, ur->member_of) {
-                        _cleanup_free_ char *membership = strjoin(ur->user_name, ":", *g);
+                        _cleanup_free_ char *membership = strjoin(ur->user_name, ":", *g, ".membership");
                         if (!membership)
                                 return log_oom();
 
@@ -1442,7 +1442,7 @@ static int load_credential_one(
                 }
         else
                 STRV_FOREACH(u, gr->members) {
-                        _cleanup_free_ char *membership = strjoin(*u, ":", gr->group_name);
+                        _cleanup_free_ char *membership = strjoin(*u, ":", gr->group_name, ".membership");
                         if (!membership)
                                 return log_oom();