diff --git a/src/core/exec-invoke.c b/src/core/exec-invoke.c
index a0b0a87a65..298fd0754e 100644
--- a/src/core/exec-invoke.c
+++ b/src/core/exec-invoke.c
@@ -4530,10 +4530,8 @@ static bool exec_needs_cap_sys_admin(const ExecContext *context, const ExecParam
                context->bind_log_sockets > 0 ||
                context->n_bind_mounts > 0 ||
                context->n_temporary_filesystems > 0 ||
-               context->root_directory ||
-               context->root_directory_as_fd ||
+               exec_context_with_rootfs_strict(context) ||
                !strv_isempty(context->extension_directories) ||
-               context->root_image ||
                context->n_mount_images > 0 ||
                context->n_extension_images > 0 ||
                context->protect_system != PROTECT_SYSTEM_NO ||
diff --git a/src/core/execute.c b/src/core/execute.c
index 51d6996e72..8e5796b92a 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -2063,6 +2063,16 @@ bool exec_context_with_rootfs(const ExecContext *c) {
         return !empty_or_root(c->root_directory) || c->root_image || c->root_directory_as_fd;
 }
 
+bool exec_context_with_rootfs_strict(const ExecContext *c) {
+        assert(c);
+
+        /* just like exec_context_with_rootfs(), but doesn't suppress a root directory of "/", i.e. returns
+         * true in more cases: when a root directory is explicitly configured, even if it's our usual
+         * root. */
+
+        return c->root_directory || c->root_image || c->root_directory_as_fd;
+}
+
 int exec_context_has_vpicked_extensions(const ExecContext *context) {
         int r;
 
diff --git a/src/core/execute.h b/src/core/execute.h
index 6624c3a71c..6fe0d5e570 100644
--- a/src/core/execute.h
+++ b/src/core/execute.h
@@ -577,6 +577,7 @@ char** exec_context_get_restrict_filesystems(const ExecContext *c);
 bool exec_context_restrict_namespaces_set(const ExecContext *c);
 bool exec_context_restrict_filesystems_set(const ExecContext *c);
 bool exec_context_with_rootfs(const ExecContext *c);
+bool exec_context_with_rootfs_strict(const ExecContext *c);
 
 int exec_context_has_vpicked_extensions(const ExecContext *context);