diff --git a/man/userdbctl.xml b/man/userdbctl.xml
index 896ad22256..0871306b20 100644
--- a/man/userdbctl.xml
+++ b/man/userdbctl.xml
@@ -39,7 +39,10 @@
     url="https://systemd.io/USER_RECORD">JSON User Records</ulink> and <ulink
     url="https://systemd.io/GROUP_RECORD">JSON Group Records</ulink> definitions), and classic UNIX NSS/glibc
     user and group records. This tool is primarily a client to the <ulink
-    url="https://systemd.io/USER_GROUP_API">User/Group Record Lookup API via Varlink</ulink>.</para>
+    url="https://systemd.io/USER_GROUP_API">User/Group Record Lookup API via Varlink</ulink>, and may also
+    pick up drop-in JSON user and group records from <filename>/etc/userdb/</filename>,
+    <filename>/run/userdb/</filename>, <filename>/run/host/userdb/</filename>,
+    <filename>/use/lib/userdb/</filename>.</para>
   </refsect1>
 
   <refsect1>
@@ -86,6 +89,27 @@
         are included in the output (which is the default).</para></listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><option>--with-varlink=</option><replaceable>BOOL</replaceable></term>
+
+        <listitem><para>Controls whether to include Varlink user/group lookups in the output, i.e. those done
+        via the <ulink url="https://systemd.io/USER_GROUP_API">User/Group Record Lookup API via
+        Varlink</ulink>. If <option>--with-varlink=no</option> is used any attempts to resolve or enumerate
+        users/groups provided only via Varlink are suppressed. If <option>--with-varlink=yes</option> is
+        specified such users/groups are included in the output (which is the default).</para></listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>--with-dropin=</option><replaceable>BOOL</replaceable></term>
+
+        <listitem><para>Controls whether to include user/group lookups in the output that are defined using
+        drop-in files in <filename>/etc/userdb/</filename>, <filename>/run/userdb/</filename>,
+        <filename>/run/host/userdb/</filename>, <filename>/use/lib/userdb/</filename>. If
+        <option>--with-dropin=no</option> is used these records are suppressed. If
+        <option>--with-dropin=yes</option> is specified such users/groups are included in the output (which
+        is the default).</para></listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><option>--synthesize=</option><replaceable>BOOL</replaceable></term>
 
@@ -228,6 +252,17 @@
         data, however the NSS/glibc APIs necessarily expose a more reduced set of fields
         only.</para></listitem>
       </varlistentry>
+
+      <varlistentry>
+        <term><constant>io.systemd.DropIn</constant></term>
+
+        <listitem><para>This service is (also) provided by
+        <citerefentry><refentrytitle>systemd-userdbd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+        and picks up JSON user/group records from <filename>/etc/userdb/</filename>,
+        <filename>/run/userdb/</filename>, <filename>/run/host/userdb/</filename>,
+        <filename>/use/lib/userdb/</filename>.</para></listitem>
+      </varlistentry>
+
     </variablelist>
 
     <para>Note that <command>userdbctl</command> has internal support for NSS-based lookups too. This means
diff --git a/src/userdb/userdbctl.c b/src/userdb/userdbctl.c
index 56511eae44..8db0c34fb5 100644
--- a/src/userdb/userdbctl.c
+++ b/src/userdb/userdbctl.c
@@ -601,6 +601,8 @@ static int help(int argc, char *argv[], void *userdata) {
                "  -N                         Do not synthesize or include glibc NSS data\n"
                "                             (Same as --synthesize=no --with-nss=no)\n"
                "     --synthesize=BOOL       Synthesize root/nobody user\n"
+               "     --with-dropin=BOOL      Control whether to include drop-in records\n"
+               "     --with-varlink=BOOL     Control whether to talk to services at all\n"
                "\nSee the %s for details.\n",
                program_invocation_short_name,
                ansi_highlight(),
@@ -618,18 +620,22 @@ static int parse_argv(int argc, char *argv[]) {
                 ARG_NO_LEGEND,
                 ARG_OUTPUT,
                 ARG_WITH_NSS,
+                ARG_WITH_DROPIN,
+                ARG_WITH_VARLINK,
                 ARG_SYNTHESIZE,
         };
 
         static const struct option options[] = {
-                { "help",       no_argument,       NULL, 'h'            },
-                { "version",    no_argument,       NULL, ARG_VERSION    },
-                { "no-pager",   no_argument,       NULL, ARG_NO_PAGER   },
-                { "no-legend",  no_argument,       NULL, ARG_NO_LEGEND  },
-                { "output",     required_argument, NULL, ARG_OUTPUT     },
-                { "service",    required_argument, NULL, 's'            },
-                { "with-nss",   required_argument, NULL, ARG_WITH_NSS   },
-                { "synthesize", required_argument, NULL, ARG_SYNTHESIZE },
+                { "help",         no_argument,       NULL, 'h'             },
+                { "version",      no_argument,       NULL, ARG_VERSION     },
+                { "no-pager",     no_argument,       NULL, ARG_NO_PAGER    },
+                { "no-legend",    no_argument,       NULL, ARG_NO_LEGEND   },
+                { "output",       required_argument, NULL, ARG_OUTPUT      },
+                { "service",      required_argument, NULL, 's'             },
+                { "with-nss",     required_argument, NULL, ARG_WITH_NSS    },
+                { "with-dropin",  required_argument, NULL, ARG_WITH_DROPIN },
+                { "with-varlink", required_argument, NULL, ARG_WITH_VARLINK },
+                { "synthesize",   required_argument, NULL, ARG_SYNTHESIZE  },
                 {}
         };
 
@@ -728,6 +734,22 @@ static int parse_argv(int argc, char *argv[]) {
                         SET_FLAG(arg_userdb_flags, USERDB_EXCLUDE_NSS, !r);
                         break;
 
+                case ARG_WITH_DROPIN:
+                        r = parse_boolean_argument("--with-dropin=", optarg, NULL);
+                        if (r < 0)
+                                return r;
+
+                        SET_FLAG(arg_userdb_flags, USERDB_EXCLUDE_DROPIN, !r);
+                        break;
+
+                case ARG_WITH_VARLINK:
+                        r = parse_boolean_argument("--with-varlink=", optarg, NULL);
+                        if (r < 0)
+                                return r;
+
+                        SET_FLAG(arg_userdb_flags, USERDB_EXCLUDE_VARLINK, !r);
+                        break;
+
                 case ARG_SYNTHESIZE:
                         r = parse_boolean_argument("--synthesize=", optarg, NULL);
                         if (r < 0)