diff --git a/src/basic/capability-util.c b/src/basic/capability-util.c
index 0aaf8c3807..2f0e0ccf92 100644
--- a/src/basic/capability-util.c
+++ b/src/basic/capability-util.c
@@ -396,8 +396,9 @@ bool capability_quintet_mangle(CapabilityQuintet *q) {
 
         combined = q->effective | q->bounding | q->inheritable | q->permitted | q->ambient;
 
-        BIT_FOREACH(i, combined) {
-                assert((unsigned) i <= cap_last_cap());
+        for (unsigned i = 0; i <= cap_last_cap(); i++) {
+                if (!BIT_SET(combined, i))
+                        continue;
 
                 if (prctl(PR_CAPBSET_READ, (unsigned long) i) > 0)
                         continue;
diff --git a/test/units/TEST-13-NSPAWN.nspawn.sh b/test/units/TEST-13-NSPAWN.nspawn.sh
index 22b1abd57c..ffe5e8507d 100755
--- a/test/units/TEST-13-NSPAWN.nspawn.sh
+++ b/test/units/TEST-13-NSPAWN.nspawn.sh
@@ -312,6 +312,7 @@ EOF
     # Assorted tests
     systemd-nspawn --directory="$root" --suppress-sync=yes bash -xec 'echo hello'
     systemd-nspawn --capability=help
+    systemd-nspawn --directory="$root" --capability=all bash -xec 'echo hello'
     systemd-nspawn --resolv-conf=help
     systemd-nspawn --timezone=help