diff --git a/test/test-functions b/test/test-functions
index 556346d7d57..42b00387898 100644
--- a/test/test-functions
+++ b/test/test-functions
@@ -157,6 +157,7 @@ BASICTOOLS=(
     bash
     capsh
     cat
+    chgrp
     chmod
     chown
     chroot
@@ -2870,14 +2871,14 @@ inst_binary() {
 
     # Same as above, but we need to wrap certain libraries unconditionally
     #
-    # chown, getent, login, setfacl, su, useradd, userdel
+    # chgrp, chown, getent, login, setfacl, su, useradd, userdel
     #    - dlopen() (not only) systemd's PAM modules
     # ls, mkfs.*, mksquashfs, mkswap, setpriv, stat
     #   - pull in nss_systemd with certain options (like ls -l) when
     #     nsswitch.conf uses [SUCCESS=merge] (like on Arch Linux)
     # delv, dig - pull in nss_resolve if `resolve` is in nsswitch.conf
     # tar - called by machinectl in TEST-25
-    bin_rx='/(agetty|chown|curl|delv|dig|getfacl|getent|id|login|ls|mkfs\.[a-z0-9]+|mksquashfs|mkswap|setfacl|setpriv|stat|su|tar|useradd|userdel)$'
+    bin_rx='/(agetty|chgrp|chown|curl|delv|dig|getfacl|getent|id|login|ls|mkfs\.[a-z0-9]+|mksquashfs|mkswap|setfacl|setpriv|stat|su|tar|useradd|userdel)$'
     if get_bool "$IS_BUILT_WITH_ASAN" && [[ "$bin" =~ $bin_rx ]]; then
         wrap_binary=1
         # Ugh, so we want to disable LSan in most cases for the wrapped binaries, since
diff --git a/test/units/testsuite-04.journal-remote.sh b/test/units/testsuite-04.journal-remote.sh
index c543129da95..b7d9cbd81ba 100755
--- a/test/units/testsuite-04.journal-remote.sh
+++ b/test/units/testsuite-04.journal-remote.sh
@@ -161,8 +161,8 @@ openssl x509 -req -days 7 \
              -CA /run/systemd/remote-pki/ca.crt \
              -CAkey /run/systemd/remote-pki/ca.key \
              -out /run/systemd/remote-pki/server.crt
-setfacl -R -m "u:systemd-journal-remote:rwX" /run/systemd/remote-pki
-setfacl -R -m "u:systemd-journal-upload:rwX" /run/systemd/remote-pki
+chown -R systemd-journal-remote:systemd-journal /run/systemd/remote-pki
+chmod -R g+rwX /run/systemd/remote-pki
 
 # Reconfigure journal-upload/journal remote with the new keys
 cat >/run/systemd/journal-remote.conf.d/99-test.conf <<EOF
@@ -215,7 +215,8 @@ cat >/run/systemd/system/systemd-journal-upload.service.d/99-test.conf <<EOF
 Restart=no
 EOF
 systemctl daemon-reload
-setfacl -R -m "u:systemd-journal-upload:rwX" /run/systemd/journal-remote-tls
+chgrp -R systemd-journal /run/systemd/journal-remote-tls
+chmod -R g+rwX /run/systemd/journal-remote-tls
 
 systemctl restart systemd-journal-upload
 timeout 10 bash -xec 'while [[ "$(systemctl show -P ActiveState systemd-journal-upload)" != failed ]]; do sleep 1; done'