diff --git a/mkosi.images/system/mkosi.postinst.chroot b/mkosi.images/system/mkosi.postinst.chroot
index 5683d5ca53..de333f364b 100755
--- a/mkosi.images/system/mkosi.postinst.chroot
+++ b/mkosi.images/system/mkosi.postinst.chroot
@@ -38,7 +38,7 @@ TTYVHangup=no
 CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
 EOF
     # ASAN and syscall filters aren't compatible with each other.
-    find / -name '*.service' -type f -exec sed -i 's/^\(MemoryDeny\|SystemCall\)/# \1/' {} +
+    find /usr /etc -name '*.service' -type f -exec sed -i 's/^\(MemoryDeny\|SystemCall\)/# \1/' {} +
 
     # `systemd-hwdb update` takes > 50s when built with sanitizers so let's not run it by default.
     systemctl mask systemd-hwdb-update.service