diff --git a/src/core/dbus-unit.c b/src/core/dbus-unit.c
index c2b562458b..eff73591fd 100644
--- a/src/core/dbus-unit.c
+++ b/src/core/dbus-unit.c
@@ -34,6 +34,7 @@
 #include "strv.h"
 #include "transaction.h"                /* IWYU pragma: keep */
 #include "unit-name.h"
+#include "user-util.h"
 #include "web-util.h"
 
 static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_collect_mode, collect_mode, CollectMode);
@@ -1649,6 +1650,9 @@ int bus_unit_method_attach_processes(sd_bus_message *message, void *userdata, sd
                         if (r == 0)
                                 return sd_bus_error_setf(reterr_error, SD_BUS_ERROR_ACCESS_DENIED, "Process " PID_FMT " not owned by client's UID. Refusing.", pidref->pid);
 
+                        if (!uid_is_valid(u->ref_uid)) /* process_is_owned_by_uid() requires a valid uid */
+                                return sd_bus_error_setf(reterr_error, SD_BUS_ERROR_ACCESS_DENIED, "Unit does not have a valid ref_uid, refusing to attach process " PID_FMT ".", pidref->pid);
+
                         r = process_is_owned_by_uid(pidref, u->ref_uid);
                         if (r < 0)
                                 return sd_bus_error_set_errnof(reterr_error, r, "Failed to check if process " PID_FMT " is owned by target unit's UID: %m", pidref->pid);
diff --git a/test/units/TEST-07-PID1.attach_processes.sh b/test/units/TEST-07-PID1.attach_processes.sh
new file mode 100755
index 0000000000..433d201f13
--- /dev/null
+++ b/test/units/TEST-07-PID1.attach_processes.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
+set -eux
+
+# Assert when calling AttachProcesses on a unit without ref_uid set
+
+at_exit() {
+    set +e
+
+    systemctl stop attach_and_barf.service
+    rm -f /run/systemd/system/attach_and_barf.service
+    systemctl daemon-reload
+}
+
+trap at_exit EXIT
+
+mkdir -p /run/systemd/system
+
+cat >/run/systemd/system/attach_and_barf.service <<EOF
+[Service]
+Type=simple
+Delegate=yes
+ExecStart=sleep infinity
+EOF
+
+systemctl daemon-reload
+systemctl start attach_and_barf.service
+run0 -u testuser \
+    busctl --system call \
+        org.freedesktop.systemd1 \
+        /org/freedesktop/systemd1 \
+        org.freedesktop.systemd1.Manager \
+        AttachProcessesToUnit \
+        "ssau" "attach_and_barf.service" "" 1 0 |& grep -F "Access denied" &>/dev/null