diff --git a/.github/workflows/unit-tests-musl.sh b/.github/workflows/unit-tests-musl.sh
index 6ba448adaf..ab7cdf0a70 100755
--- a/.github/workflows/unit-tests-musl.sh
+++ b/.github/workflows/unit-tests-musl.sh
@@ -47,7 +47,7 @@ for phase in "${PHASES[@]}"; do
             # correctly detect the environment.
             env \
                 SYSTEMD_IN_CHROOT=yes \
-                meson test -C build --print-errorlogs
+                meson test -C build --print-errorlogs --no-stdsplit
             ;;
         CLEANUP)
             info "Cleanup phase"
diff --git a/.github/workflows/unit-tests.sh b/.github/workflows/unit-tests.sh
index ceecaf3fe0..c119a86011 100755
--- a/.github/workflows/unit-tests.sh
+++ b/.github/workflows/unit-tests.sh
@@ -109,7 +109,7 @@ for phase in "${PHASES[@]}"; do
             run_meson -Dnobody-group=nogroup --werror -Dtests=unsafe -Dslow-tests=true -Dfuzz-tests=true "${MESON_ARGS[@]}" build
             ninja -C build -v
             # Ensure setting a timezone (like the reproducible build tests do) does not break time/date unit tests
-            TZ=GMT+12 meson test "${MESON_TEST_ARGS[@]}" -C build --print-errorlogs
+            TZ=GMT+12 meson test "${MESON_TEST_ARGS[@]}" -C build --print-errorlogs --no-stdsplit
             ;;
         RUN_ASAN_UBSAN|RUN_GCC_ASAN_UBSAN|RUN_CLANG_ASAN_UBSAN|RUN_CLANG_ASAN_UBSAN_NO_DEPS)
             # TODO: drop after we switch to ubuntu 26.04
@@ -151,7 +151,7 @@ for phase in "${PHASES[@]}"; do
             # during debugging, wonderful), so let's at least keep a workaround
             # here to make the builds stable for the time being.
             (set +x; while :; do echo -ne "\n[WATCHDOG] $(date)\n"; sleep 30; done) &
-            meson test --timeout-multiplier=3 -C build --print-errorlogs
+            meson test --timeout-multiplier=3 -C build --print-errorlogs --no-stdsplit
             ;;
         CLEANUP)
             info "Cleanup phase"
diff --git a/src/test/test-execute.c b/src/test/test-execute.c
index 4c33474942..d5b7e3416c 100644
--- a/src/test/test-execute.c
+++ b/src/test/test-execute.c
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include <fnmatch.h>
+#include <gnu/libc-version.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <sys/mount.h>
@@ -368,6 +369,12 @@ static void test_exec_workingdirectory(Manager *m) {
 }
 
 static void test_exec_execsearchpath(Manager *m) {
+        int r;
+
+        ASSERT_OK(r = is_symlink("/bin/ls"));
+        if (r > 0)
+                return (void) log_tests_skipped("/bin/ls is a symlink, maybe coreutils is built with --enable-single-binary=symlinks");
+
         ASSERT_OK(mkdir_p("/tmp/test-exec_execsearchpath", 0755));
 
         ASSERT_OK(copy_file("/bin/ls", "/tmp/test-exec_execsearchpath/ls_temp", 0,  0777, COPY_REPLACE));
@@ -1170,6 +1177,9 @@ static void test_exec_capabilityboundingset(Manager *m) {
 }
 
 static void test_exec_basic(Manager *m) {
+        if (isempty(gnu_get_libc_version()))
+                return (void) log_tests_skipped("ConditionVersion=glibc will not pass under musl");
+
         if (MANAGER_IS_SYSTEM(m) || have_userns_privileges())
                 test(m, "exec-basic.service", can_unshare || MANAGER_IS_SYSTEM(m) ? 0 : EXIT_NAMESPACE, CLD_EXITED);
         else
diff --git a/src/test/test-seccomp.c b/src/test/test-seccomp.c
index 0a34584cff..e81355abdd 100644
--- a/src/test/test-seccomp.c
+++ b/src/test/test-seccomp.c
@@ -611,7 +611,10 @@ TEST(memory_deny_write_execute_shmat) {
                 void *p;
 
                 p = shmat(shmid, NULL, 0);
-                assert_se(p != MAP_FAILED);
+                if (p == MAP_FAILED) {
+                        log_tests_skipped_errno(errno, "shmat() is already disabled");
+                        _exit(EXIT_SUCCESS);
+                }
                 assert_se(shmdt(p) == 0);
 
                 p = shmat(shmid, NULL, SHM_EXEC);
diff --git a/test/integration-tests/TEST-04-JOURNAL/TEST-04-JOURNAL.units/forever-print-hola.service b/test/integration-tests/TEST-04-JOURNAL/TEST-04-JOURNAL.units/forever-print-hola.service
index 9273d6d3fb..6858ceb29b 100644
--- a/test/integration-tests/TEST-04-JOURNAL/TEST-04-JOURNAL.units/forever-print-hola.service
+++ b/test/integration-tests/TEST-04-JOURNAL/TEST-04-JOURNAL.units/forever-print-hola.service
@@ -4,4 +4,4 @@ Description=ForeverPrintHola service
 
 [Service]
 Type=exec
-ExecStart=sh -x -c 'while :; do printf "Hola\n" || touch /tmp/i-lose-my-logs; sleep 1; done'
+ExecStart=bash -x -c 'while :; do printf "Hola\n" || touch /tmp/i-lose-my-logs; sleep 1; done'
diff --git a/test/integration-tests/TEST-07-PID1/TEST-07-PID1.units/defer-reactivation.service b/test/integration-tests/TEST-07-PID1/TEST-07-PID1.units/defer-reactivation.service
index 9c7332d6c9..de30aff603 100644
--- a/test/integration-tests/TEST-07-PID1/TEST-07-PID1.units/defer-reactivation.service
+++ b/test/integration-tests/TEST-07-PID1/TEST-07-PID1.units/defer-reactivation.service
@@ -3,4 +3,4 @@ Description=Test for DeferReactivation=yes (service)
 
 [Service]
 Type=simple
-ExecStart=sh -c 'date +%%s >>/tmp/defer-reactivation.log; sleep 5'
+ExecStart=bash -c 'date +%%s >>/tmp/defer-reactivation.log; sleep 5'
diff --git a/test/integration-tests/TEST-07-PID1/TEST-07-PID1.units/issue27953.service b/test/integration-tests/TEST-07-PID1/TEST-07-PID1.units/issue27953.service
index f441067822..ca75d37add 100644
--- a/test/integration-tests/TEST-07-PID1/TEST-07-PID1.units/issue27953.service
+++ b/test/integration-tests/TEST-07-PID1/TEST-07-PID1.units/issue27953.service
@@ -4,4 +4,4 @@ Description=This unit should not remain active once the shell process exits
 
 [Service]
 Type=oneshot
-ExecStart=sh -c 'sleep infinity & exit 0'
+ExecStart=bash -c 'sleep infinity & exit 0'
diff --git a/test/integration-tests/TEST-07-PID1/meson.build b/test/integration-tests/TEST-07-PID1/meson.build
index 678fc5f0ec..39077437a0 100644
--- a/test/integration-tests/TEST-07-PID1/meson.build
+++ b/test/integration-tests/TEST-07-PID1/meson.build
@@ -7,7 +7,7 @@ integration_tests += [
                         'service' : integration_test_template['configuration']['service'] + {
                                 'NotifyAccess' : 'all',
                                 # Issue: https://github.com/systemd/systemd/issues/2691
-                                'ExecStop' : 'sh -c \'kill -SEGV $$$$\'',
+                                'ExecStop' : 'bash -c \'kill -SEGV $$$$\'',
                                 'RemainAfterExit' : 'yes',
                                 'TimeoutStopSec' : '270s',
                         },
diff --git a/test/integration-tests/TEST-17-UDEV/meson.build b/test/integration-tests/TEST-17-UDEV/meson.build
index 1d72c56e8c..58f809ba29 100644
--- a/test/integration-tests/TEST-17-UDEV/meson.build
+++ b/test/integration-tests/TEST-17-UDEV/meson.build
@@ -4,6 +4,6 @@ integration_tests += [
         integration_test_template + {
                 'name' : fs.name(meson.current_source_dir()),
                 'vm' : true,
-                'coredump-exclude-regex' : '/(sleep|udevadm)$',
+                'coredump-exclude-regex' : '/(coreutils|sleep|udevadm)$',
         },
 ]
diff --git a/test/integration-tests/TEST-23-UNIT-FILE/TEST-23-UNIT-FILE.units/TEST-23-UNIT-FILE-namespaced.service b/test/integration-tests/TEST-23-UNIT-FILE/TEST-23-UNIT-FILE.units/TEST-23-UNIT-FILE-namespaced.service
index 82eb74c0bd..3823614504 100644
--- a/test/integration-tests/TEST-23-UNIT-FILE/TEST-23-UNIT-FILE.units/TEST-23-UNIT-FILE-namespaced.service
+++ b/test/integration-tests/TEST-23-UNIT-FILE/TEST-23-UNIT-FILE.units/TEST-23-UNIT-FILE-namespaced.service
@@ -10,4 +10,4 @@ PrivateTmp=yes
 BindPaths=/run/TEST-23-UNIT-FILE-marker-fixed:/tmp/testfile-marker-fixed
 InaccessiblePaths=/run/inaccessible
 ExecStartPre=grep -q -F MARKER_FIXED /tmp/testfile-marker-fixed
-ExecStart=sh -c 'systemd-notify --ready; until grep -q -F MARKER_RUNTIME /tmp/testfile-marker-runtime; do sleep 0.1; done; test ! -f /run/inaccessible/testfile-marker-fixed'
+ExecStart=bash -c 'systemd-notify --ready; until grep -q -F MARKER_RUNTIME /tmp/testfile-marker-runtime; do sleep 0.1; done; test ! -f /run/inaccessible/testfile-marker-fixed'
diff --git a/test/integration-tests/TEST-23-UNIT-FILE/TEST-23-UNIT-FILE.units/TEST-23-UNIT-FILE-non-namespaced.service b/test/integration-tests/TEST-23-UNIT-FILE/TEST-23-UNIT-FILE.units/TEST-23-UNIT-FILE-non-namespaced.service
index 699b6080d3..bb94a4629e 100644
--- a/test/integration-tests/TEST-23-UNIT-FILE/TEST-23-UNIT-FILE.units/TEST-23-UNIT-FILE-non-namespaced.service
+++ b/test/integration-tests/TEST-23-UNIT-FILE/TEST-23-UNIT-FILE.units/TEST-23-UNIT-FILE-non-namespaced.service
@@ -3,4 +3,4 @@
 RuntimeMaxSec=5
 Type=notify
 RemainAfterExit=yes
-ExecStart=sh -c 'systemd-notify --ready; until grep -q -F MARKER_RUNTIME /tmp/testfile-marker-runtime; do sleep 0.1; done; exit 0'
+ExecStart=bash -c 'systemd-notify --ready; until grep -q -F MARKER_RUNTIME /tmp/testfile-marker-runtime; do sleep 0.1; done; exit 0'
diff --git a/test/integration-tests/TEST-23-UNIT-FILE/TEST-23-UNIT-FILE.units/TEST-23-UNIT-FILE-retry-fail.service b/test/integration-tests/TEST-23-UNIT-FILE/TEST-23-UNIT-FILE.units/TEST-23-UNIT-FILE-retry-fail.service
index 319757a44d..bf68ca2dda 100644
--- a/test/integration-tests/TEST-23-UNIT-FILE/TEST-23-UNIT-FILE.units/TEST-23-UNIT-FILE-retry-fail.service
+++ b/test/integration-tests/TEST-23-UNIT-FILE/TEST-23-UNIT-FILE.units/TEST-23-UNIT-FILE-retry-fail.service
@@ -5,5 +5,5 @@ Description=Failed Dependency Unit
 [Service]
 Type=oneshot
 RemainAfterExit=yes
-ExecStart=sh -c "if [ -f /tmp/TEST-23-UNIT-FILE-retry-fail ]; then exit 0; else exit 1; fi"
+ExecStart=bash -c "if [ -f /tmp/TEST-23-UNIT-FILE-retry-fail ]; then exit 0; else exit 1; fi"
 Restart=no
diff --git a/test/integration-tests/TEST-52-HONORFIRSTSHUTDOWN/TEST-52-HONORFIRSTSHUTDOWN.units/test-honor-first-shutdown.service b/test/integration-tests/TEST-52-HONORFIRSTSHUTDOWN/TEST-52-HONORFIRSTSHUTDOWN.units/test-honor-first-shutdown.service
index bbeac3a74e..687d749156 100644
--- a/test/integration-tests/TEST-52-HONORFIRSTSHUTDOWN/TEST-52-HONORFIRSTSHUTDOWN.units/test-honor-first-shutdown.service
+++ b/test/integration-tests/TEST-52-HONORFIRSTSHUTDOWN/TEST-52-HONORFIRSTSHUTDOWN.units/test-honor-first-shutdown.service
@@ -5,7 +5,7 @@ After=multi-user.target
 
 [Service]
 ExecStart=/usr/lib/systemd/tests/testdata/TEST-52-HONORFIRSTSHUTDOWN.units/%N.sh
-ExecStop=sh -c 'kill -KILL $MAINPID'
+ExecStop=bash -c 'kill -KILL $MAINPID'
 FailureAction=reboot
 
 [Install]
diff --git a/test/integration-tests/TEST-59-RELOADING-RESTART/meson.build b/test/integration-tests/TEST-59-RELOADING-RESTART/meson.build
index 3d12024cef..f5fae753e2 100644
--- a/test/integration-tests/TEST-59-RELOADING-RESTART/meson.build
+++ b/test/integration-tests/TEST-59-RELOADING-RESTART/meson.build
@@ -3,6 +3,6 @@
 integration_tests += [
         integration_test_template + {
                 'name' : fs.name(meson.current_source_dir()),
-                'coredump-exclude-regex' : '/(sleep|bash|systemd-notify)$',
+                'coredump-exclude-regex' : '/(coreutils|sleep|bash|systemd-notify)$',
         },
 ]
diff --git a/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-1.service b/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-1.service
index 16695c18a2..dc0bea2c50 100644
--- a/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-1.service
+++ b/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-1.service
@@ -2,8 +2,8 @@
 [Unit]
 Description=TEST-62-RESTRICT-IFACES-all-pings-work
 [Service]
-ExecStart=sh -c 'ping -c 1 -W 0.2 192.168.113.1'
-ExecStart=sh -c 'ping -c 1 -W 0.2 192.168.113.5'
-ExecStart=sh -c 'ping -c 1 -W 0.2 192.168.113.9'
+ExecStart=bash -c 'ping -c 1 -W 0.2 192.168.113.1'
+ExecStart=bash -c 'ping -c 1 -W 0.2 192.168.113.5'
+ExecStart=bash -c 'ping -c 1 -W 0.2 192.168.113.9'
 RestrictNetworkInterfaces=
 Type=oneshot
diff --git a/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-2.service b/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-2.service
index bce7e8e6cb..7bbb2149fd 100644
--- a/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-2.service
+++ b/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-2.service
@@ -2,9 +2,9 @@
 [Unit]
 Description=TEST-62-RESTRICT-IFACES-allow-list
 [Service]
-ExecStart=sh -c 'ping -c 1 -W 0.2 192.168.113.1'
-ExecStart=sh -c 'ping -c 1 -W 0.2 192.168.113.5'
-ExecStart=sh -c '! ping -c 1 -W 0.2 192.168.113.9'
+ExecStart=bash -c 'ping -c 1 -W 0.2 192.168.113.1'
+ExecStart=bash -c 'ping -c 1 -W 0.2 192.168.113.5'
+ExecStart=bash -c '! ping -c 1 -W 0.2 192.168.113.9'
 RestrictNetworkInterfaces=veth0
 RestrictNetworkInterfaces=veth1
 Type=oneshot
diff --git a/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-3.service b/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-3.service
index 116530bad3..bf70ab24a7 100644
--- a/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-3.service
+++ b/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-3.service
@@ -2,9 +2,9 @@
 [Unit]
 Description=TEST-62-RESTRICT-IFACES-deny-list
 [Service]
-ExecStart=sh -c '! ping -c 1 -W 0.2 192.168.113.1'
-ExecStart=sh -c '! ping -c 1 -W 0.2 192.168.113.5'
-ExecStart=sh -c 'ping -c 1 -W 0.2 192.168.113.9'
+ExecStart=bash -c '! ping -c 1 -W 0.2 192.168.113.1'
+ExecStart=bash -c '! ping -c 1 -W 0.2 192.168.113.5'
+ExecStart=bash -c 'ping -c 1 -W 0.2 192.168.113.9'
 RestrictNetworkInterfaces=~veth0
 RestrictNetworkInterfaces=~veth1
 Type=oneshot
diff --git a/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-4.service b/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-4.service
index 200a38355a..7e22a32b0c 100644
--- a/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-4.service
+++ b/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-4.service
@@ -2,9 +2,9 @@
 [Unit]
 Description=TEST-62-RESTRICT-IFACES-empty-assignment
 [Service]
-ExecStart=sh -c 'ping -c 1 -W 0.2 192.168.113.1'
-ExecStart=sh -c 'ping -c 1 -W 0.2 192.168.113.5'
-ExecStart=sh -c 'ping -c 1 -W 0.2 192.168.113.9'
+ExecStart=bash -c 'ping -c 1 -W 0.2 192.168.113.1'
+ExecStart=bash -c 'ping -c 1 -W 0.2 192.168.113.5'
+ExecStart=bash -c 'ping -c 1 -W 0.2 192.168.113.9'
 RestrictNetworkInterfaces=veth0
 RestrictNetworkInterfaces=
 Type=oneshot
diff --git a/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-5.service b/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-5.service
index 51761ba27e..20fe462918 100644
--- a/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-5.service
+++ b/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-5.service
@@ -2,9 +2,9 @@
 [Unit]
 Description=TEST-62-RESTRICT-IFACES-invert-assignment
 [Service]
-ExecStart=sh -c '! ping -c 1 -W 0.2 192.168.113.1'
-ExecStart=sh -c 'ping -c 1 -W 0.2 192.168.113.5'
-ExecStart=sh -c '! ping -c 1 -W 0.2 192.168.113.9'
+ExecStart=bash -c '! ping -c 1 -W 0.2 192.168.113.1'
+ExecStart=bash -c 'ping -c 1 -W 0.2 192.168.113.5'
+ExecStart=bash -c '! ping -c 1 -W 0.2 192.168.113.9'
 RestrictNetworkInterfaces=veth0
 RestrictNetworkInterfaces=veth0 veth1
 RestrictNetworkInterfaces=~veth0
diff --git a/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-6.service b/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-6.service
index b7e91f7e68..e0c13ca5d1 100644
--- a/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-6.service
+++ b/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-6.service
@@ -2,9 +2,9 @@
 [Unit]
 Description=TEST-62-RESTRICT-IFACES-altname
 [Service]
-ExecStart=sh -c 'ping -c 1 -W 0.2 192.168.113.1'
-ExecStart=sh -c 'ping -c 1 -W 0.2 192.168.113.5'
-ExecStart=sh -c '! ping -c 1 -W 0.2 192.168.113.9'
+ExecStart=bash -c 'ping -c 1 -W 0.2 192.168.113.1'
+ExecStart=bash -c 'ping -c 1 -W 0.2 192.168.113.5'
+ExecStart=bash -c '! ping -c 1 -W 0.2 192.168.113.9'
 RestrictNetworkInterfaces=veth0-altname-with-more-than-15-chars
 RestrictNetworkInterfaces=veth1-altname-with-more-than-15-chars
 Type=oneshot
diff --git a/test/integration-tests/TEST-63-PATH/TEST-63-PATH.units/test63-glob.service b/test/integration-tests/TEST-63-PATH/TEST-63-PATH.units/test63-glob.service
index 3f49dd4620..50818a8d10 100644
--- a/test/integration-tests/TEST-63-PATH/TEST-63-PATH.units/test63-glob.service
+++ b/test/integration-tests/TEST-63-PATH/TEST-63-PATH.units/test63-glob.service
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 [Service]
-ExecStartPre=sh -c 'test "$TRIGGER_PATH" = /tmp/test63-glob-foo'
-ExecStartPre=sh -c 'test "$TRIGGER_UNIT" = test63-glob.path'
+ExecStartPre=bash -c 'test "$TRIGGER_PATH" = /tmp/test63-glob-foo'
+ExecStartPre=bash -c 'test "$TRIGGER_UNIT" = test63-glob.path'
 ExecStart=systemd-notify --ready
 RemainAfterExit=yes
 Type=notify
diff --git a/test/integration-tests/TEST-63-PATH/TEST-63-PATH.units/test63.service b/test/integration-tests/TEST-63-PATH/TEST-63-PATH.units/test63.service
index 01a928b8d6..b6360f7794 100644
--- a/test/integration-tests/TEST-63-PATH/TEST-63-PATH.units/test63.service
+++ b/test/integration-tests/TEST-63-PATH/TEST-63-PATH.units/test63.service
@@ -3,6 +3,6 @@
 ConditionPathExists=/tmp/nonexistent
 
 [Service]
-ExecStartPre=sh -c 'test "$TRIGGER_PATH" = /tmp/test63'
-ExecStartPre=sh -c 'test "$TRIGGER_UNIT" = test63.path'
+ExecStartPre=bash -c 'test "$TRIGGER_PATH" = /tmp/test63'
+ExecStartPre=bash -c 'test "$TRIGGER_UNIT" = test63.path'
 ExecStart=true
diff --git a/test/test-execute/exec-ambientcapabilities-dynuser.service b/test/test-execute/exec-ambientcapabilities-dynuser.service
index b927c7dbca..7e3faffcc7 100644
--- a/test/test-execute/exec-ambientcapabilities-dynuser.service
+++ b/test/test-execute/exec-ambientcapabilities-dynuser.service
@@ -3,7 +3,7 @@
 Description=Test for AmbientCapabilities (dynamic user)
 
 [Service]
-ExecStart=sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000002081"'
+ExecStart=bash -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000002081"'
 Type=oneshot
 AmbientCapabilities=CAP_CHOWN CAP_SETUID CAP_NET_RAW
 DynamicUser=yes
diff --git a/test/test-execute/exec-ambientcapabilities-merge-nfsnobody.service b/test/test-execute/exec-ambientcapabilities-merge-nfsnobody.service
index a170b3d7b6..d2a30ef851 100644
--- a/test/test-execute/exec-ambientcapabilities-merge-nfsnobody.service
+++ b/test/test-execute/exec-ambientcapabilities-merge-nfsnobody.service
@@ -3,7 +3,7 @@
 Description=Test for AmbientCapabilities
 
 [Service]
-ExecStart=sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000002001"'
+ExecStart=bash -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000002001"'
 Type=oneshot
 User=nfsnobody
 AmbientCapabilities=CAP_CHOWN
diff --git a/test/test-execute/exec-ambientcapabilities-merge-nobody.service b/test/test-execute/exec-ambientcapabilities-merge-nobody.service
index 2e21bbc58a..af6cf01771 100644
--- a/test/test-execute/exec-ambientcapabilities-merge-nobody.service
+++ b/test/test-execute/exec-ambientcapabilities-merge-nobody.service
@@ -3,7 +3,7 @@
 Description=Test for AmbientCapabilities
 
 [Service]
-ExecStart=sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000002001"'
+ExecStart=bash -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000002001"'
 Type=oneshot
 User=nobody
 AmbientCapabilities=CAP_CHOWN
diff --git a/test/test-execute/exec-ambientcapabilities-merge.service b/test/test-execute/exec-ambientcapabilities-merge.service
index c4bb21b2ac..fc5e9b1ffe 100644
--- a/test/test-execute/exec-ambientcapabilities-merge.service
+++ b/test/test-execute/exec-ambientcapabilities-merge.service
@@ -3,7 +3,7 @@
 Description=Test for AmbientCapabilities (daemon)
 
 [Service]
-ExecStart=sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000002001"'
+ExecStart=bash -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000002001"'
 Type=oneshot
 User=daemon
 AmbientCapabilities=CAP_CHOWN
diff --git a/test/test-execute/exec-ambientcapabilities-nfsnobody.service b/test/test-execute/exec-ambientcapabilities-nfsnobody.service
index 0bf91cc98f..6670018baa 100644
--- a/test/test-execute/exec-ambientcapabilities-nfsnobody.service
+++ b/test/test-execute/exec-ambientcapabilities-nfsnobody.service
@@ -3,7 +3,7 @@
 Description=Test for AmbientCapabilities
 
 [Service]
-ExecStart=sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000002001"'
+ExecStart=bash -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000002001"'
 Type=oneshot
 User=nfsnobody
 AmbientCapabilities=CAP_CHOWN CAP_NET_RAW
diff --git a/test/test-execute/exec-ambientcapabilities-nobody.service b/test/test-execute/exec-ambientcapabilities-nobody.service
index 8bd7ac4f90..c8438f2ee1 100644
--- a/test/test-execute/exec-ambientcapabilities-nobody.service
+++ b/test/test-execute/exec-ambientcapabilities-nobody.service
@@ -3,7 +3,7 @@
 Description=Test for AmbientCapabilities
 
 [Service]
-ExecStart=sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000002001"'
+ExecStart=bash -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000002001"'
 Type=oneshot
 User=nobody
 AmbientCapabilities=CAP_CHOWN CAP_NET_RAW
diff --git a/test/test-execute/exec-ambientcapabilities.service b/test/test-execute/exec-ambientcapabilities.service
index 1bbc727031..1481ce0716 100644
--- a/test/test-execute/exec-ambientcapabilities.service
+++ b/test/test-execute/exec-ambientcapabilities.service
@@ -3,7 +3,7 @@
 Description=Test for AmbientCapabilities (daemon)
 
 [Service]
-ExecStart=sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000002001"'
+ExecStart=bash -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000002001"'
 Type=oneshot
 User=daemon
 AmbientCapabilities=CAP_CHOWN CAP_NET_RAW
diff --git a/test/test-execute/exec-basic.service b/test/test-execute/exec-basic.service
index c29d46c2df..b6cdb10391 100644
--- a/test/test-execute/exec-basic.service
+++ b/test/test-execute/exec-basic.service
@@ -27,7 +27,7 @@ ConditionVersion=glibc " >= 2" " <= 9000 " "!= 1"
 ConditionVersion=glibc " >= 2" " * "
 
 [Service]
-ExecStart=touch /tmp/a ; /bin/sh -c 'touch /tmp/b' ; touch /tmp/c
+ExecStart=touch /tmp/a ; bash -c 'touch /tmp/b' ; touch /tmp/c
 ExecStart=test -f /tmp/a
 ExecStart=!test -f /tmp/b
 ExecStart=!!test -f /tmp/c
diff --git a/test/test-execute/exec-bindpaths.service b/test/test-execute/exec-bindpaths.service
index 12e92e2ac5..bc68058868 100644
--- a/test/test-execute/exec-bindpaths.service
+++ b/test/test-execute/exec-bindpaths.service
@@ -11,7 +11,7 @@ ExecStart=test -f /tmp/thisisasimpletest
 # Also, through /tmp/test-exec-bindreadonlypaths
 ExecStart=test -f /tmp/test-exec-bindreadonlypaths/thisisasimpletest
 # The file cannot modify through /tmp/test-exec-bindreadonlypaths
-ExecStart=sh -x -c '! touch /tmp/test-exec-bindreadonlypaths/thisisasimpletest'
+ExecStart=bash -x -c '! touch /tmp/test-exec-bindreadonlypaths/thisisasimpletest'
 # Cleanup
 ExecStart=rm /tmp/thisisasimpletest
 BindPaths=/tmp:/tmp/test-exec-bindpaths
diff --git a/test/test-execute/exec-capabilityboundingset-invert.service b/test/test-execute/exec-capabilityboundingset-invert.service
index 14f16c6b56..92aabc5875 100644
--- a/test/test-execute/exec-capabilityboundingset-invert.service
+++ b/test/test-execute/exec-capabilityboundingset-invert.service
@@ -4,6 +4,6 @@ Description=Test for CapabilityBoundingSet
 
 [Service]
 # sed: remove dropped (cap_xxx-[epi]) and IAB capabilities from the output
-ExecStart=sh -x -c '! capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep "^Bounding set .*cap_chown"'
+ExecStart=bash -x -c '! capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep "^Bounding set .*cap_chown"'
 Type=oneshot
 CapabilityBoundingSet=~CAP_CHOWN
diff --git a/test/test-execute/exec-capabilityboundingset-merge.service b/test/test-execute/exec-capabilityboundingset-merge.service
index d3a23706ee..30746a93af 100644
--- a/test/test-execute/exec-capabilityboundingset-merge.service
+++ b/test/test-execute/exec-capabilityboundingset-merge.service
@@ -3,7 +3,7 @@
 Description=Test for CapabilityBoundingSet
 
 [Service]
-ExecStart=sh -x -c 'c=$$(capsh --print | grep "Bounding set "); test "$$c" = "Bounding set =cap_chown,cap_fowner,cap_kill"'
+ExecStart=bash -x -c 'c=$$(capsh --print | grep "Bounding set "); test "$$c" = "Bounding set =cap_chown,cap_fowner,cap_kill"'
 Type=oneshot
 CapabilityBoundingSet=CAP_FOWNER
 CapabilityBoundingSet=CAP_KILL CAP_CHOWN
diff --git a/test/test-execute/exec-capabilityboundingset-reset.service b/test/test-execute/exec-capabilityboundingset-reset.service
index 2443951651..7354a1cb83 100644
--- a/test/test-execute/exec-capabilityboundingset-reset.service
+++ b/test/test-execute/exec-capabilityboundingset-reset.service
@@ -3,7 +3,7 @@
 Description=Test for CapabilityBoundingSet
 
 [Service]
-ExecStart=sh -x -c 'c=$$(capsh --print | grep "Bounding set "); test "$$c" = "Bounding set ="'
+ExecStart=bash -x -c 'c=$$(capsh --print | grep "Bounding set "); test "$$c" = "Bounding set ="'
 Type=oneshot
 CapabilityBoundingSet=CAP_FOWNER CAP_KILL
 CapabilityBoundingSet=
diff --git a/test/test-execute/exec-capabilityboundingset-simple.service b/test/test-execute/exec-capabilityboundingset-simple.service
index 3df3e6d9ae..9c149264d3 100644
--- a/test/test-execute/exec-capabilityboundingset-simple.service
+++ b/test/test-execute/exec-capabilityboundingset-simple.service
@@ -3,6 +3,6 @@
 Description=Test for CapabilityBoundingSet
 
 [Service]
-ExecStart=sh -x -c 'c=$$(capsh --print | grep "Bounding set "); test "$$c" = "Bounding set =cap_fowner,cap_kill"'
+ExecStart=bash -x -c 'c=$$(capsh --print | grep "Bounding set "); test "$$c" = "Bounding set =cap_fowner,cap_kill"'
 Type=oneshot
 CapabilityBoundingSet=CAP_FOWNER CAP_KILL
diff --git a/test/test-execute/exec-condition-failed.service b/test/test-execute/exec-condition-failed.service
index eb136fff5d..6c6f6cfd12 100644
--- a/test/test-execute/exec-condition-failed.service
+++ b/test/test-execute/exec-condition-failed.service
@@ -6,7 +6,7 @@ Description=Test for exec condition that fails the unit
 Type=oneshot
 
 # exit 255 will fail the unit
-ExecCondition=/bin/sh -c 'exit 255'
+ExecCondition=bash -c 'exit 255'
 
 # This should not get run
-ExecStart=sh -c 'true'
+ExecStart=bash -c 'true'
diff --git a/test/test-execute/exec-condition-skip.service b/test/test-execute/exec-condition-skip.service
index 4ee58b9c11..554e7c6fbd 100644
--- a/test/test-execute/exec-condition-skip.service
+++ b/test/test-execute/exec-condition-skip.service
@@ -6,11 +6,11 @@ Description=Test for exec condition that triggers skipping
 Type=oneshot
 
 # exit codes [1, 254] will result in skipping the rest of execution
-ExecCondition=/bin/sh -c 'exit 0'
-ExecCondition=/bin/sh -c 'exit 254'
+ExecCondition=bash -c 'exit 0'
+ExecCondition=bash -c 'exit 254'
 
 # This would normally fail the unit but will not get run due to the skip above
-ExecCondition=/bin/sh -c 'exit 255'
+ExecCondition=bash -c 'exit 255'
 
 # This should not get run
-ExecStart=sh -c 'true'
+ExecStart=bash -c 'true'
diff --git a/test/test-execute/exec-cpuaffinity1.service b/test/test-execute/exec-cpuaffinity1.service
index c0941a5579..4229ebee4e 100644
--- a/test/test-execute/exec-cpuaffinity1.service
+++ b/test/test-execute/exec-cpuaffinity1.service
@@ -3,5 +3,5 @@
 Description=Test for CPUAffinity (simple)
 
 [Service]
-ExecStart=sh -c 'test $$(cat /proc/self/status | grep Cpus_allowed: | rev | cut -c 1) = 1'
+ExecStart=bash -c 'test $$(cat /proc/self/status | grep Cpus_allowed: | rev | cut -c 1) = 1'
 CPUAffinity=0
diff --git a/test/test-execute/exec-cpuaffinity2.service b/test/test-execute/exec-cpuaffinity2.service
index d699ecc031..e0d8e76d3b 100644
--- a/test/test-execute/exec-cpuaffinity2.service
+++ b/test/test-execute/exec-cpuaffinity2.service
@@ -3,7 +3,7 @@
 Description=Test for CPUAffinity (reset)
 
 [Service]
-ExecStart=sh -c 'test $$(cat /proc/self/status | grep Cpus_allowed: | rev | cut -c 1) = 1'
+ExecStart=bash -c 'test $$(cat /proc/self/status | grep Cpus_allowed: | rev | cut -c 1) = 1'
 CPUAffinity=0-1 3
 CPUAffinity=
 CPUAffinity=0
diff --git a/test/test-execute/exec-cpuaffinity3.service b/test/test-execute/exec-cpuaffinity3.service
index 8e8f782ac3..61ebd5b2ea 100644
--- a/test/test-execute/exec-cpuaffinity3.service
+++ b/test/test-execute/exec-cpuaffinity3.service
@@ -3,6 +3,6 @@
 Description=Test for CPUAffinity (merge)
 
 [Service]
-ExecStart=sh -c 'test $$(cat /proc/self/status | grep Cpus_allowed: | rev | cut -c 1) = 7'
+ExecStart=bash -c 'test $$(cat /proc/self/status | grep Cpus_allowed: | rev | cut -c 1) = 7'
 CPUAffinity=0,1
 CPUAffinity=1-2
diff --git a/test/test-execute/exec-credentials-dir-specifier.service b/test/test-execute/exec-credentials-dir-specifier.service
index 5e71eee246..2bc8f07248 100644
--- a/test/test-execute/exec-credentials-dir-specifier.service
+++ b/test/test-execute/exec-credentials-dir-specifier.service
@@ -9,10 +9,10 @@ Environment=TOP_SECRET=%d/very_top_secret
 ExecStart=test %d/very_top_secret = "${CREDENTIALS_DIRECTORY}/very_top_secret"
 LoadCredential=very_top_secret
 ExecStart=test %d/very_top_secret = "${CREDENTIALS_DIRECTORY}/very_top_secret"
-ExecStart=sh -c 'test %d/very_top_secret = "$TOP_SECRET"'
+ExecStart=bash -c 'test %d/very_top_secret = "$TOP_SECRET"'
 ExecStartPost=test %d/very_top_secret = "${CREDENTIALS_DIRECTORY}/very_top_secret"
-ExecStartPost=sh -c 'test %d/very_top_secret = "$TOP_SECRET"'
+ExecStartPost=bash -c 'test %d/very_top_secret = "$TOP_SECRET"'
 ExecStop=test %d/very_top_secret = "${CREDENTIALS_DIRECTORY}/very_top_secret"
-ExecStop=sh -c 'test %d/very_top_secret = "$TOP_SECRET"'
+ExecStop=bash -c 'test %d/very_top_secret = "$TOP_SECRET"'
 ExecStopPost=test %d/very_top_secret = "${CREDENTIALS_DIRECTORY}/very_top_secret"
-ExecStopPost=sh -c 'test %d/very_top_secret = "$TOP_SECRET"'
+ExecStopPost=bash -c 'test %d/very_top_secret = "$TOP_SECRET"'
diff --git a/test/test-execute/exec-dynamicuser-fixeduser-adm.service b/test/test-execute/exec-dynamicuser-fixeduser-adm.service
index 3a7f8aef60..5255a010ca 100644
--- a/test/test-execute/exec-dynamicuser-fixeduser-adm.service
+++ b/test/test-execute/exec-dynamicuser-fixeduser-adm.service
@@ -5,9 +5,9 @@ Description=Test DynamicUser with static User= whose uid and gid are different
 
 [Service]
 Type=oneshot
-ExecStart=sh -x -c 'test "$$(id -nG)" = "adm" && test "$$(id -ng)" = "adm" && test "$$(id -nu)" = "adm"'
+ExecStart=bash -x -c 'test "$$(id -nG)" = "adm" && test "$$(id -ng)" = "adm" && test "$$(id -nu)" = "adm"'
 # Multiple ExecStart= lines causes the issue #9702.
-ExecStart=sh -x -c 'test "$$(id -nG)" = "adm" && test "$$(id -ng)" = "adm" && test "$$(id -nu)" = "adm"'
+ExecStart=bash -x -c 'test "$$(id -nG)" = "adm" && test "$$(id -ng)" = "adm" && test "$$(id -nu)" = "adm"'
 DynamicUser=yes
 User=adm
 ReadWritePaths=-/coverage
diff --git a/test/test-execute/exec-dynamicuser-fixeduser-games.service b/test/test-execute/exec-dynamicuser-fixeduser-games.service
index 40048d27a8..6043589745 100644
--- a/test/test-execute/exec-dynamicuser-fixeduser-games.service
+++ b/test/test-execute/exec-dynamicuser-fixeduser-games.service
@@ -2,12 +2,13 @@
 [Unit]
 Description=Test DynamicUser with static User= whose uid and gid are different
 # On Ubuntu or Debian, user games has uid==5 and gid==60.
+# On Alpine/postmarketOS, the user 'games' in the 'games' and 'users' groups.
 
 [Service]
 Type=oneshot
-ExecStart=sh -x -c 'test "$$(id -nG)" = "games" && test "$$(id -ng)" = "games" && test "$$(id -nu)" = "games"'
+ExecStart=bash -x -c '[[ "$$(id -nG)" =~ "games" ]] && test "$$(id -ng)" = "games" && test "$$(id -nu)" = "games"'
 # Multiple ExecStart= lines causes the issue #9702.
-ExecStart=sh -x -c 'test "$$(id -nG)" = "games" && test "$$(id -ng)" = "games" && test "$$(id -nu)" = "games"'
+ExecStart=bash -x -c '[[ "$$(id -nG)" =~ "games" ]] && test "$$(id -ng)" = "games" && test "$$(id -nu)" = "games"'
 DynamicUser=yes
 User=games
 ReadWritePaths=-/coverage
diff --git a/test/test-execute/exec-dynamicuser-fixeduser-one-supplementarygroup.service b/test/test-execute/exec-dynamicuser-fixeduser-one-supplementarygroup.service
index e58b524033..8a4eabb894 100644
--- a/test/test-execute/exec-dynamicuser-fixeduser-one-supplementarygroup.service
+++ b/test/test-execute/exec-dynamicuser-fixeduser-one-supplementarygroup.service
@@ -3,8 +3,8 @@
 Description=Test DynamicUser with User= and SupplementaryGroups=
 
 [Service]
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
-ExecStart=sh -x -c 'test "$$(id -g)" = "1" && test "$$(id -u)" = "1"'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'test "$$(id -g)" = "1" && test "$$(id -u)" = "1"'
 Type=oneshot
 User=1
 DynamicUser=yes
diff --git a/test/test-execute/exec-dynamicuser-fixeduser.service b/test/test-execute/exec-dynamicuser-fixeduser.service
index 8e5244d891..412198b887 100644
--- a/test/test-execute/exec-dynamicuser-fixeduser.service
+++ b/test/test-execute/exec-dynamicuser-fixeduser.service
@@ -3,8 +3,8 @@
 Description=Test DynamicUser with User=
 
 [Service]
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
-ExecStart=sh -x -c 'test "$$(id -g)" = "1" && test "$$(id -u)" = "1"'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'test "$$(id -g)" = "1" && test "$$(id -u)" = "1"'
 Type=oneshot
 User=1
 DynamicUser=yes
diff --git a/test/test-execute/exec-dynamicuser-runtimedirectory1.service b/test/test-execute/exec-dynamicuser-runtimedirectory1.service
index 671b316736..30d28aee07 100644
--- a/test/test-execute/exec-dynamicuser-runtimedirectory1.service
+++ b/test/test-execute/exec-dynamicuser-runtimedirectory1.service
@@ -3,9 +3,9 @@
 Description=Test for RuntimeDirectory with RuntimeDirectoryPreserve=yes and DynamicUser=yes
 
 [Service]
-ExecStart=sh -x -c 'test -d %t/test-exec_runtimedirectorypreserve'
-ExecStart=sh -x -c 'test "$$RUNTIME_DIRECTORY" = "%t/test-exec_runtimedirectorypreserve"'
-ExecStart=sh -x -c 'touch $$RUNTIME_DIRECTORY/test'
+ExecStart=bash -x -c 'test -d %t/test-exec_runtimedirectorypreserve'
+ExecStart=bash -x -c 'test "$$RUNTIME_DIRECTORY" = "%t/test-exec_runtimedirectorypreserve"'
+ExecStart=bash -x -c 'touch $$RUNTIME_DIRECTORY/test'
 Type=oneshot
 RuntimeDirectory=test-exec_runtimedirectorypreserve
 RuntimeDirectoryPreserve=yes
diff --git a/test/test-execute/exec-dynamicuser-runtimedirectory2.service b/test/test-execute/exec-dynamicuser-runtimedirectory2.service
index cdb80848e3..ef9ba35c06 100644
--- a/test/test-execute/exec-dynamicuser-runtimedirectory2.service
+++ b/test/test-execute/exec-dynamicuser-runtimedirectory2.service
@@ -3,10 +3,10 @@
 Description=Test for RuntimeDirectory with RuntimeDirectoryPreserve=yes and DynamicUser=yes 2nd trial
 
 [Service]
-ExecStart=sh -x -c 'test -d %t/test-exec_runtimedirectorypreserve'
-ExecStart=sh -x -c 'test "$$RUNTIME_DIRECTORY" = "%t/test-exec_runtimedirectorypreserve"'
-ExecStart=sh -x -c 'test -f $$RUNTIME_DIRECTORY/test'
-ExecStart=sh -x -c 'touch $$RUNTIME_DIRECTORY/test'
+ExecStart=bash -x -c 'test -d %t/test-exec_runtimedirectorypreserve'
+ExecStart=bash -x -c 'test "$$RUNTIME_DIRECTORY" = "%t/test-exec_runtimedirectorypreserve"'
+ExecStart=bash -x -c 'test -f $$RUNTIME_DIRECTORY/test'
+ExecStart=bash -x -c 'touch $$RUNTIME_DIRECTORY/test'
 Type=oneshot
 RuntimeDirectory=test-exec_runtimedirectorypreserve
 RuntimeDirectoryPreserve=yes
diff --git a/test/test-execute/exec-dynamicuser-runtimedirectory3.service b/test/test-execute/exec-dynamicuser-runtimedirectory3.service
index 51a9e44c6f..a8ee6facf9 100644
--- a/test/test-execute/exec-dynamicuser-runtimedirectory3.service
+++ b/test/test-execute/exec-dynamicuser-runtimedirectory3.service
@@ -3,10 +3,10 @@
 Description=Test for RuntimeDirectory with DynamicUser=yes migrated from RuntimeDirectoryPreserve=yes
 
 [Service]
-ExecStart=sh -x -c 'test -d %t/test-exec_runtimedirectorypreserve'
-ExecStart=sh -x -c 'test "$$RUNTIME_DIRECTORY" = "%t/test-exec_runtimedirectorypreserve"'
-ExecStart=sh -x -c 'test -f $$RUNTIME_DIRECTORY/test'
-ExecStart=sh -x -c 'touch $$RUNTIME_DIRECTORY/test'
+ExecStart=bash -x -c 'test -d %t/test-exec_runtimedirectorypreserve'
+ExecStart=bash -x -c 'test "$$RUNTIME_DIRECTORY" = "%t/test-exec_runtimedirectorypreserve"'
+ExecStart=bash -x -c 'test -f $$RUNTIME_DIRECTORY/test'
+ExecStart=bash -x -c 'touch $$RUNTIME_DIRECTORY/test'
 Type=oneshot
 RuntimeDirectory=test-exec_runtimedirectorypreserve
 DynamicUser=yes
diff --git a/test/test-execute/exec-dynamicuser-statedir-migrate-step1.service b/test/test-execute/exec-dynamicuser-statedir-migrate-step1.service
index 12375afbb5..855a3aa64e 100644
--- a/test/test-execute/exec-dynamicuser-statedir-migrate-step1.service
+++ b/test/test-execute/exec-dynamicuser-statedir-migrate-step1.service
@@ -11,7 +11,7 @@ ExecStart=test -d %S/test-dynamicuser-migrate
 ExecStart=test -d %S/test-dynamicuser-migrate2/hoge
 ExecStart=touch %S/test-dynamicuser-migrate/yay
 ExecStart=touch %S/test-dynamicuser-migrate2/hoge/yayyay
-ExecStart=sh -x -c 'test "$$STATE_DIRECTORY" = "%S/test-dynamicuser-migrate:%S/test-dynamicuser-migrate2/hoge"'
+ExecStart=bash -x -c 'test "$$STATE_DIRECTORY" = "%S/test-dynamicuser-migrate:%S/test-dynamicuser-migrate2/hoge"'
 
 Type=oneshot
 DynamicUser=no
diff --git a/test/test-execute/exec-dynamicuser-statedir-migrate-step2.service b/test/test-execute/exec-dynamicuser-statedir-migrate-step2.service
index f22862378c..92a421bfc1 100644
--- a/test/test-execute/exec-dynamicuser-statedir-migrate-step2.service
+++ b/test/test-execute/exec-dynamicuser-statedir-migrate-step2.service
@@ -19,7 +19,7 @@ ExecStart=touch %S/test-dynamicuser-migrate/yay
 ExecStart=touch %S/test-dynamicuser-migrate2/hoge/yayyay
 ExecStart=touch %S/private/test-dynamicuser-migrate/yay
 ExecStart=touch %S/private/test-dynamicuser-migrate2/hoge/yayyay
-ExecStart=sh -x -c 'test "$$STATE_DIRECTORY" = "%S/test-dynamicuser-migrate:%S/test-dynamicuser-migrate2/hoge"'
+ExecStart=bash -x -c 'test "$$STATE_DIRECTORY" = "%S/test-dynamicuser-migrate:%S/test-dynamicuser-migrate2/hoge"'
 
 Type=oneshot
 DynamicUser=yes
diff --git a/test/test-execute/exec-dynamicuser-statedir.service b/test/test-execute/exec-dynamicuser-statedir.service
index 1e4fe818ac..d52684ebde 100644
--- a/test/test-execute/exec-dynamicuser-statedir.service
+++ b/test/test-execute/exec-dynamicuser-statedir.service
@@ -78,7 +78,7 @@ ExecStart=test -f %S/private/xxx/foo
 ExecStart=test -f %S/private/xxx/yyy/foo
 ExecStart=test -f %S/private/xxx/zzz/foo
 
-ExecStart=sh -x -c 'test "$$STATE_DIRECTORY" = "%S/aaa:%S/aaa/bbb:%S/aaa/ccc:%S/abc:%S/quux/pief:%S/waldo:%S/xxx:%S/xxx/yyy:%S/xxx/zzz"'
+ExecStart=bash -x -c 'test "$$STATE_DIRECTORY" = "%S/aaa:%S/aaa/bbb:%S/aaa/ccc:%S/abc:%S/quux/pief:%S/waldo:%S/xxx:%S/xxx/yyy:%S/xxx/zzz"'
 
 Type=oneshot
 DynamicUser=yes
diff --git a/test/test-execute/exec-dynamicuser-supplementarygroups.service b/test/test-execute/exec-dynamicuser-supplementarygroups.service
index fd88a790e4..13fc61599e 100644
--- a/test/test-execute/exec-dynamicuser-supplementarygroups.service
+++ b/test/test-execute/exec-dynamicuser-supplementarygroups.service
@@ -3,8 +3,8 @@
 Description=Test DynamicUser with SupplementaryGroups=
 
 [Service]
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "2" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "2" && exit 0; done; exit 1'
 Type=oneshot
 DynamicUser=yes
 SupplementaryGroups=1 2
diff --git a/test/test-execute/exec-environment-empty.service b/test/test-execute/exec-environment-empty.service
index e5af6ffe68..ff373d51b0 100644
--- a/test/test-execute/exec-environment-empty.service
+++ b/test/test-execute/exec-environment-empty.service
@@ -3,7 +3,7 @@
 Description=Test for Environment
 
 [Service]
-ExecStart=sh -x -c 'test "$${VAR1-unset}" = "unset" && test "$${VAR2-unset}" = "unset" && test "$${VAR3-unset}" = "unset"'
+ExecStart=bash -x -c 'test "$${VAR1-unset}" = "unset" && test "$${VAR2-unset}" = "unset" && test "$${VAR3-unset}" = "unset"'
 Type=oneshot
 Environment="VAR1=word1 word2" VAR2=word3 "VAR3=$word 5 6"
 Environment=
diff --git a/test/test-execute/exec-environment-multiple.service b/test/test-execute/exec-environment-multiple.service
index 4199a46d84..c6565f492b 100644
--- a/test/test-execute/exec-environment-multiple.service
+++ b/test/test-execute/exec-environment-multiple.service
@@ -3,7 +3,7 @@
 Description=Test for Environment
 
 [Service]
-ExecStart=sh -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = foobar'
+ExecStart=bash -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = foobar'
 Type=oneshot
 Environment="VAR1=word1 word2" VAR2=word3 "VAR3=$word 5 6"
 Environment="VAR3=foobar"
diff --git a/test/test-execute/exec-environment-no-substitute.service b/test/test-execute/exec-environment-no-substitute.service
index 7396576d7d..6748c1292a 100644
--- a/test/test-execute/exec-environment-no-substitute.service
+++ b/test/test-execute/exec-environment-no-substitute.service
@@ -3,7 +3,7 @@
 Description=Test for No Environment Variable Substitution
 
 [Service]
-ExecStart=sh -x -c 'test "$${VAR1-unset}" = "unset" && test "$${VAR2}" = "word3" && test "$${VAR3-unset}" = \'$word 5 6\''
-ExecStart=:/bin/sh -x -c 'test "$${VAR1-unset}" != "unset" && test "$${VAR2}" != "word3" && test "$${VAR3-unset}" != \'$word 5 6\''
+ExecStart=bash -x -c 'test "$${VAR1-unset}" = "unset" && test "$${VAR2}" = "word3" && test "$${VAR3-unset}" = \'$word 5 6\''
+ExecStart=:bash -x -c 'test "$${VAR1-unset}" != "unset" && test "$${VAR2}" != "word3" && test "$${VAR3-unset}" != \'$word 5 6\''
 Type=oneshot
 Environment="VAR2=word3" "VAR3=$word 5 6"
diff --git a/test/test-execute/exec-environment.service b/test/test-execute/exec-environment.service
index 7e3cb0ef42..d20875840c 100644
--- a/test/test-execute/exec-environment.service
+++ b/test/test-execute/exec-environment.service
@@ -3,6 +3,6 @@
 Description=Test for Environment
 
 [Service]
-ExecStart=sh -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6"'
+ExecStart=bash -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6"'
 Type=oneshot
 Environment="VAR1=word1 word2" VAR2=word3 "VAR3=$word 5 6"
diff --git a/test/test-execute/exec-environmentfile.service b/test/test-execute/exec-environmentfile.service
index 3f739fa1e0..4331dd2109 100644
--- a/test/test-execute/exec-environmentfile.service
+++ b/test/test-execute/exec-environmentfile.service
@@ -3,6 +3,6 @@
 Description=Test for EnvironmentFile
 
 [Service]
-ExecStart=sh -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$VAR4" = "new\nline" && test "$$VAR5" = passwordwithbackslashes'
+ExecStart=bash -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$VAR4" = "new\nline" && test "$$VAR5" = passwordwithbackslashes'
 Type=oneshot
 EnvironmentFile=/tmp/test-exec_environmentfile.conf
diff --git a/test/test-execute/exec-execsearchpath-environment-path-set.service b/test/test-execute/exec-execsearchpath-environment-path-set.service
index 424c4ac7b6..b6d3481d27 100644
--- a/test/test-execute/exec-execsearchpath-environment-path-set.service
+++ b/test/test-execute/exec-execsearchpath-environment-path-set.service
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 [Service]
-ExecStart=sh -x -c 'test "$$PATH" = "/usr" && test "$$VAR1" = word3 && test "$$VAR2" = "\\$$word 5 6"'
+ExecStart=bash -x -c 'test "$$PATH" = "/usr" && test "$$VAR1" = word3 && test "$$VAR2" = "\\$$word 5 6"'
 Type=oneshot
 ExecSearchPath=/tmp:/bin
 Environment="PATH=/usr" VAR1=word3 "VAR2=$word 5 6"
diff --git a/test/test-execute/exec-execsearchpath-environment.service b/test/test-execute/exec-execsearchpath-environment.service
index 5c39d9ca63..aed95cbe9e 100644
--- a/test/test-execute/exec-execsearchpath-environment.service
+++ b/test/test-execute/exec-execsearchpath-environment.service
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 [Service]
-ExecStart=sh -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$PATH" = "/tmp:/bin"'
+ExecStart=bash -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$PATH" = "/tmp:/bin"'
 Type=oneshot
 ExecSearchPath=/tmp:/bin
 Environment="VAR1=word1 word2" VAR2=word3 "VAR3=$word 5 6"
diff --git a/test/test-execute/exec-execsearchpath-environmentfile-set.service b/test/test-execute/exec-execsearchpath-environmentfile-set.service
index 8741582231..279c83da10 100644
--- a/test/test-execute/exec-execsearchpath-environmentfile-set.service
+++ b/test/test-execute/exec-execsearchpath-environmentfile-set.service
@@ -3,7 +3,7 @@
 Description=Test for ExecSearchPath with EnvironmentFile where EnvironmentFile sets PATH
 
 [Service]
-ExecStart=sh -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$VAR4" = "new\nline" && test "$$VAR5" = passwordwithbackslashes && test "$$PATH" = /usr'
+ExecStart=bash -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$VAR4" = "new\nline" && test "$$VAR5" = passwordwithbackslashes && test "$$PATH" = /usr'
 Type=oneshot
 EnvironmentFile=/tmp/test-exec_execsearchpath_environmentfile-set.conf
 ExecSearchPath=/tmp:/bin
diff --git a/test/test-execute/exec-execsearchpath-environmentfile.service b/test/test-execute/exec-execsearchpath-environmentfile.service
index 53cede8f1b..29150f4b9f 100644
--- a/test/test-execute/exec-execsearchpath-environmentfile.service
+++ b/test/test-execute/exec-execsearchpath-environmentfile.service
@@ -3,7 +3,7 @@
 Description=Test for ExecSearchPath with EnvironmentFile where EnvironmentFile does not set PATH
 
 [Service]
-ExecStart=sh -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$VAR4" = "new\nline" && test "$$VAR5" = passwordwithbackslashes && test "$$PATH" = "/tmp:/bin"'
+ExecStart=bash -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$VAR4" = "new\nline" && test "$$VAR5" = passwordwithbackslashes && test "$$PATH" = "/tmp:/bin"'
 Type=oneshot
 ExecSearchPath=/tmp:/bin
 EnvironmentFile=/tmp/test-exec_execsearchpath_environmentfile.conf
diff --git a/test/test-execute/exec-execsearchpath-passenvironment-set.service b/test/test-execute/exec-execsearchpath-passenvironment-set.service
index 2d4e75a0c8..05e8f93dbd 100644
--- a/test/test-execute/exec-execsearchpath-passenvironment-set.service
+++ b/test/test-execute/exec-execsearchpath-passenvironment-set.service
@@ -3,7 +3,7 @@
 Description=Test for PassEnvironment with ExecSearchPath with PATH set by user
 
 [Service]
-ExecStart=sh -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$VAR4" = "new\nline" && test "$$VAR5" = passwordwithbackslashes && test "$$PATH" = "/usr"'
+ExecStart=bash -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$VAR4" = "new\nline" && test "$$VAR5" = passwordwithbackslashes && test "$$PATH" = "/usr"'
 Type=oneshot
 PassEnvironment=VAR1 VAR2 VAR3 VAR4 VAR5 PATH
 ExecSearchPath=/tmp:/bin
diff --git a/test/test-execute/exec-execsearchpath-passenvironment.service b/test/test-execute/exec-execsearchpath-passenvironment.service
index 5bdab47193..373afcee7b 100644
--- a/test/test-execute/exec-execsearchpath-passenvironment.service
+++ b/test/test-execute/exec-execsearchpath-passenvironment.service
@@ -3,7 +3,7 @@
 Description=Test for PassEnvironment with ExecSearchPath with PATH not set by user
 
 [Service]
-ExecStart=sh -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$VAR4" = "new\nline" && test "$$VAR5" = passwordwithbackslashes && test "$$PATH" = "/tmp:/bin"'
+ExecStart=bash -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$VAR4" = "new\nline" && test "$$VAR5" = passwordwithbackslashes && test "$$PATH" = "/tmp:/bin"'
 Type=oneshot
 PassEnvironment=VAR1 VAR2 VAR3 VAR4 VAR5
 ExecSearchPath=/tmp:/bin
diff --git a/test/test-execute/exec-execsearchpath-unit-specifier.service b/test/test-execute/exec-execsearchpath-unit-specifier.service
index a2037e930d..56e4f3f563 100644
--- a/test/test-execute/exec-execsearchpath-unit-specifier.service
+++ b/test/test-execute/exec-execsearchpath-unit-specifier.service
@@ -5,4 +5,4 @@ Description=Test for specifiers with exec search path
 [Service]
 Type=oneshot
 ExecSearchPath=/tmp:/bin:/usr/bin:%V
-ExecStart=sh -x -c 'test %V = /var/tmp && test "$$PATH" = "/tmp:/bin:/usr/bin:/var/tmp"'
+ExecStart=bash -x -c 'test %V = /var/tmp && test "$$PATH" = "/tmp:/bin:/usr/bin:/var/tmp"'
diff --git a/test/test-execute/exec-group-nfsnobody.service b/test/test-execute/exec-group-nfsnobody.service
index aebb1984a1..b9d0ac9a8b 100644
--- a/test/test-execute/exec-group-nfsnobody.service
+++ b/test/test-execute/exec-group-nfsnobody.service
@@ -3,6 +3,6 @@
 Description=Test for Group
 
 [Service]
-ExecStart=sh -x -c 'test "$$(id -n -g)" = "nfsnobody"'
+ExecStart=bash -x -c 'test "$$(id -n -g)" = "nfsnobody"'
 Type=oneshot
 Group=nfsnobody
diff --git a/test/test-execute/exec-group-nobody.service b/test/test-execute/exec-group-nobody.service
index cf283cb657..c4adb5f8fa 100644
--- a/test/test-execute/exec-group-nobody.service
+++ b/test/test-execute/exec-group-nobody.service
@@ -3,6 +3,6 @@
 Description=Test for Group
 
 [Service]
-ExecStart=sh -x -c 'test "$$(id -n -g)" = "nobody"'
+ExecStart=bash -x -c 'test "$$(id -n -g)" = "nobody"'
 Type=oneshot
 Group=nobody
diff --git a/test/test-execute/exec-group-nogroup.service b/test/test-execute/exec-group-nogroup.service
index 46c3dd3acf..bfdc9afa66 100644
--- a/test/test-execute/exec-group-nogroup.service
+++ b/test/test-execute/exec-group-nogroup.service
@@ -3,6 +3,6 @@
 Description=Test for Group
 
 [Service]
-ExecStart=sh -x -c 'test "$$(id -n -g)" = "nogroup"'
+ExecStart=bash -x -c 'test "$$(id -n -g)" = "nogroup"'
 Type=oneshot
 Group=nogroup
diff --git a/test/test-execute/exec-group.service b/test/test-execute/exec-group.service
index bd5ac2db34..5bfc4e9a2d 100644
--- a/test/test-execute/exec-group.service
+++ b/test/test-execute/exec-group.service
@@ -3,6 +3,6 @@
 Description=Test for Group (daemon)
 
 [Service]
-ExecStart=sh -x -c 'test "$$(id -n -g)" = "daemon"'
+ExecStart=bash -x -c 'test "$$(id -n -g)" = "daemon"'
 Type=oneshot
 Group=daemon
diff --git a/test/test-execute/exec-ignoresigpipe-no.service b/test/test-execute/exec-ignoresigpipe-no.service
index ce8b258712..caedab1447 100644
--- a/test/test-execute/exec-ignoresigpipe-no.service
+++ b/test/test-execute/exec-ignoresigpipe-no.service
@@ -3,6 +3,6 @@
 Description=Test for IgnoreSIGPIPE=no
 
 [Service]
-ExecStart=sh -x -c 'kill -PIPE 0'
+ExecStart=bash -x -c 'kill -PIPE 0'
 Type=oneshot
 IgnoreSIGPIPE=no
diff --git a/test/test-execute/exec-ignoresigpipe-yes.service b/test/test-execute/exec-ignoresigpipe-yes.service
index a26f53c413..bc093c0c0a 100644
--- a/test/test-execute/exec-ignoresigpipe-yes.service
+++ b/test/test-execute/exec-ignoresigpipe-yes.service
@@ -3,6 +3,6 @@
 Description=Test for IgnoreSIGPIPE=yes
 
 [Service]
-ExecStart=sh -x -c 'kill -PIPE 0'
+ExecStart=bash -x -c 'kill -PIPE 0'
 Type=oneshot
 IgnoreSIGPIPE=yes
diff --git a/test/test-execute/exec-inaccessiblepaths-mount-propagation.service b/test/test-execute/exec-inaccessiblepaths-mount-propagation.service
index 8580f5208e..fbe754455c 100644
--- a/test/test-execute/exec-inaccessiblepaths-mount-propagation.service
+++ b/test/test-execute/exec-inaccessiblepaths-mount-propagation.service
@@ -4,5 +4,5 @@ Description=Test to make sure that InaccessiblePaths= disconnect mount propagati
 
 [Service]
 InaccessiblePaths=-/i-dont-exist
-ExecStart=sh -x -c 'd=$$(mktemp -d -p /tmp); trap "umount \'$$d\' && rmdir \'$$d\'" EXIT; mount -t tmpfs tmpfs "$$d"; grep "$$d" /proc/self/mountinfo && ! grep "$$d" /proc/$${PPID}/mountinfo && ! grep "$$d" /proc/1/mountinfo'
+ExecStart=bash -x -c 'd=$$(mktemp -d -p /tmp); trap "umount \'$$d\' && rmdir \'$$d\'" EXIT; mount -t tmpfs tmpfs "$$d"; grep "$$d" /proc/self/mountinfo && ! grep "$$d" /proc/$${PPID}/mountinfo && ! grep "$$d" /proc/1/mountinfo'
 Type=oneshot
diff --git a/test/test-execute/exec-inaccessiblepaths-sys.service b/test/test-execute/exec-inaccessiblepaths-sys.service
index 64a570ce4d..599b7c854c 100644
--- a/test/test-execute/exec-inaccessiblepaths-sys.service
+++ b/test/test-execute/exec-inaccessiblepaths-sys.service
@@ -4,5 +4,5 @@ Description=Test to make sure that mount namespace setup works properly with the
 
 [Service]
 InaccessiblePaths=/sys
-ExecStart=sh -x -c 'test "$$(stat -c %%a /sys)" = "0"'
+ExecStart=bash -x -c 'test "$$(stat -c %%a /sys)" = "0"'
 Type=oneshot
diff --git a/test/test-execute/exec-ioschedulingclass-best-effort.service b/test/test-execute/exec-ioschedulingclass-best-effort.service
index 569183f173..a98d54c7cf 100644
--- a/test/test-execute/exec-ioschedulingclass-best-effort.service
+++ b/test/test-execute/exec-ioschedulingclass-best-effort.service
@@ -3,6 +3,6 @@
 Description=Test for IOSchedulingClass=best-effort
 
 [Service]
-ExecStart=sh -x -c 'c=$$(LC_ALL=C ionice); test "$${c%%:*}" = "best-effort"'
+ExecStart=bash -x -c 'c=$$(LC_ALL=C ionice); test "$${c%%:*}" = "best-effort"'
 Type=oneshot
 IOSchedulingClass=best-effort
diff --git a/test/test-execute/exec-ioschedulingclass-idle.service b/test/test-execute/exec-ioschedulingclass-idle.service
index 93377ea0c0..7a62682478 100644
--- a/test/test-execute/exec-ioschedulingclass-idle.service
+++ b/test/test-execute/exec-ioschedulingclass-idle.service
@@ -3,6 +3,6 @@
 Description=Test for IOSchedulingClass=idle
 
 [Service]
-ExecStart=sh -x -c 'c=$$(LC_ALL=C ionice); test "$${c%%:*}" = "idle"'
+ExecStart=bash -x -c 'c=$$(LC_ALL=C ionice); test "$${c%%:*}" = "idle"'
 Type=oneshot
 IOSchedulingClass=idle
diff --git a/test/test-execute/exec-ioschedulingclass-none.service b/test/test-execute/exec-ioschedulingclass-none.service
index b8198d16f2..313eca79c5 100644
--- a/test/test-execute/exec-ioschedulingclass-none.service
+++ b/test/test-execute/exec-ioschedulingclass-none.service
@@ -4,6 +4,6 @@ Description=Test for IOSchedulingClass=none
 
 [Service]
 # Old kernels might report "none" here, new kernels "best-effort".
-ExecStart=sh -x -c 'c=$$(LC_ALL=C ionice); test "$${c%%:*}" = "none" -o "$${c%%:*}" = "best-effort"'
+ExecStart=bash -x -c 'c=$$(LC_ALL=C ionice); test "$${c%%:*}" = "none" -o "$${c%%:*}" = "best-effort"'
 Type=oneshot
 IOSchedulingClass=none
diff --git a/test/test-execute/exec-ioschedulingclass-realtime.service b/test/test-execute/exec-ioschedulingclass-realtime.service
index a7edb6d012..83ad99e6d4 100644
--- a/test/test-execute/exec-ioschedulingclass-realtime.service
+++ b/test/test-execute/exec-ioschedulingclass-realtime.service
@@ -3,6 +3,6 @@
 Description=Test for IOSchedulingClass=realtime
 
 [Service]
-ExecStart=sh -x -c 'c=$$(LC_ALL=C ionice); test "$${c%%:*}" = "realtime"'
+ExecStart=bash -x -c 'c=$$(LC_ALL=C ionice); test "$${c%%:*}" = "realtime"'
 Type=oneshot
 IOSchedulingClass=realtime
diff --git a/test/test-execute/exec-load-credential.service b/test/test-execute/exec-load-credential.service
index 9da19e6369..d8a0a14b86 100644
--- a/test/test-execute/exec-load-credential.service
+++ b/test/test-execute/exec-load-credential.service
@@ -3,9 +3,9 @@
 Description=Test for LoadCredential=
 
 [Service]
-ExecStart=sh -x -c 'test "$$(cat %d/test-execute.load-credential)" = "foo"'
-ExecStartPost=sh -x -c 'test "$$(cat %d/test-execute.load-credential)" = "foo"'
-ExecStop=sh -x -c 'test "$$(cat %d/test-execute.load-credential)" = "foo"'
-ExecStopPost=sh -x -c 'test "$$(cat %d/test-execute.load-credential)" = "foo"'
+ExecStart=bash -x -c 'test "$$(cat %d/test-execute.load-credential)" = "foo"'
+ExecStartPost=bash -x -c 'test "$$(cat %d/test-execute.load-credential)" = "foo"'
+ExecStop=bash -x -c 'test "$$(cat %d/test-execute.load-credential)" = "foo"'
+ExecStopPost=bash -x -c 'test "$$(cat %d/test-execute.load-credential)" = "foo"'
 Type=oneshot
 LoadCredential=test-execute.load-credential
diff --git a/test/test-execute/exec-networknamespacepath-privatemounts-no.service b/test/test-execute/exec-networknamespacepath-privatemounts-no.service
index 07c0525dcc..4aad58eb69 100644
--- a/test/test-execute/exec-networknamespacepath-privatemounts-no.service
+++ b/test/test-execute/exec-networknamespacepath-privatemounts-no.service
@@ -3,14 +3,14 @@
 Description=Test for NetworkNamespacePath= without mount namespacing
 
 [Service]
-ExecStart=sh -x -c '! ip link show dummy-test-exec'
-ExecStart=sh -x -c 'test ! -e /proc/sys/net/ipv4/conf/dummy-test-exec'
+ExecStart=bash -x -c '! ip link show dummy-test-exec'
+ExecStart=bash -x -c 'test ! -e /proc/sys/net/ipv4/conf/dummy-test-exec'
 # Without mount namespacing, we can access the dummy-test-exec interface through sysfs.
-ExecStart=sh -x -c 'test -e /sys/class/net/dummy-test-exec'
-ExecStart=sh -x -c 'ip link show dummy-test-ns'
-ExecStart=sh -x -c 'test -e /proc/sys/net/ipv4/conf/dummy-test-ns'
+ExecStart=bash -x -c 'test -e /sys/class/net/dummy-test-exec'
+ExecStart=bash -x -c 'ip link show dummy-test-ns'
+ExecStart=bash -x -c 'test -e /proc/sys/net/ipv4/conf/dummy-test-ns'
 # Without mount namespacing, we cannot access the dummy-test-ns interface through sysfs.
-ExecStart=sh -x -c 'test ! -e /sys/class/net/dummy-test-ns'
+ExecStart=bash -x -c 'test ! -e /sys/class/net/dummy-test-ns'
 Type=oneshot
 NetworkNamespacePath=/run/netns/test-execute-netns
 PrivateMounts=no
diff --git a/test/test-execute/exec-networknamespacepath-privatemounts-yes.service b/test/test-execute/exec-networknamespacepath-privatemounts-yes.service
index 10bc1923b7..9efd54ae6c 100644
--- a/test/test-execute/exec-networknamespacepath-privatemounts-yes.service
+++ b/test/test-execute/exec-networknamespacepath-privatemounts-yes.service
@@ -3,14 +3,14 @@
 Description=Test for NetworkNamespacePath= with mount namespacing
 
 [Service]
-ExecStart=sh -x -c '! ip link show dummy-test-exec'
-ExecStart=sh -x -c 'test ! -e /proc/sys/net/ipv4/conf/dummy-test-exec'
+ExecStart=bash -x -c '! ip link show dummy-test-exec'
+ExecStart=bash -x -c 'test ! -e /proc/sys/net/ipv4/conf/dummy-test-exec'
 # With mount namespacing, we cannot access the dummy-test-exec interface through sysfs.
-ExecStart=sh -x -c 'test ! -e /sys/class/net/dummy-test-exec'
-ExecStart=sh -x -c 'ip link show dummy-test-ns'
-ExecStart=sh -x -c 'test -e /proc/sys/net/ipv4/conf/dummy-test-ns'
+ExecStart=bash -x -c 'test ! -e /sys/class/net/dummy-test-exec'
+ExecStart=bash -x -c 'ip link show dummy-test-ns'
+ExecStart=bash -x -c 'test -e /proc/sys/net/ipv4/conf/dummy-test-ns'
 # With mount namespacing, we can access the dummy-test-ns interface through sysfs.
-ExecStart=sh -x -c 'test -e /sys/class/net/dummy-test-ns'
+ExecStart=bash -x -c 'test -e /sys/class/net/dummy-test-ns'
 Type=oneshot
 NetworkNamespacePath=/run/netns/test-execute-netns
 # NetworkNamespacePath= implies PrivateMounts=yes
diff --git a/test/test-execute/exec-noexecpaths-simple.service b/test/test-execute/exec-noexecpaths-simple.service
index 503be5a770..2eb8aae6ab 100644
--- a/test/test-execute/exec-noexecpaths-simple.service
+++ b/test/test-execute/exec-noexecpaths-simple.service
@@ -5,7 +5,7 @@ Description=Test for NoExecPaths=
 [Service]
 Type=oneshot
 # This should work, as we explicitly disable the effect of NoExecPaths=
-ExecStart=+/bin/sh -c '/bin/cat /dev/null'
+ExecStart=+bash -c '/bin/cat /dev/null'
 # This should also work, as we do not disable the effect of NoExecPaths= but invert the exit code
-ExecStart=sh -x -c '! /bin/cat /dev/null'
+ExecStart=bash -x -c '! /bin/cat /dev/null'
 NoExecPaths=/bin/cat
diff --git a/test/test-execute/exec-oomscoreadjust-negative.service b/test/test-execute/exec-oomscoreadjust-negative.service
index 5656030796..a6d3a52d4e 100644
--- a/test/test-execute/exec-oomscoreadjust-negative.service
+++ b/test/test-execute/exec-oomscoreadjust-negative.service
@@ -3,6 +3,6 @@
 Description=Test for OOMScoreAdjust
 
 [Service]
-ExecStart=sh -x -c 'c=$$(cat /proc/self/oom_score_adj); test "$$c" -eq -100'
+ExecStart=bash -x -c 'c=$$(cat /proc/self/oom_score_adj); test "$$c" -eq -100'
 Type=oneshot
 OOMScoreAdjust=-100
diff --git a/test/test-execute/exec-oomscoreadjust-positive.service b/test/test-execute/exec-oomscoreadjust-positive.service
index a2079b841e..1d903d3b7a 100644
--- a/test/test-execute/exec-oomscoreadjust-positive.service
+++ b/test/test-execute/exec-oomscoreadjust-positive.service
@@ -3,6 +3,6 @@
 Description=Test for OOMScoreAdjust
 
 [Service]
-ExecStart=sh -x -c 'c=$$(cat /proc/self/oom_score_adj); test "$$c" -eq 100'
+ExecStart=bash -x -c 'c=$$(cat /proc/self/oom_score_adj); test "$$c" -eq 100'
 Type=oneshot
 OOMScoreAdjust=100
diff --git a/test/test-execute/exec-passenvironment-absent.service b/test/test-execute/exec-passenvironment-absent.service
index b2e5c20016..1b92df85c7 100644
--- a/test/test-execute/exec-passenvironment-absent.service
+++ b/test/test-execute/exec-passenvironment-absent.service
@@ -3,6 +3,6 @@
 Description=Test for PassEnvironment with variables absent from the execution environment
 
 [Service]
-ExecStart=sh -x -c 'test "$${VAR1-unset}" = "unset" && test "$${VAR2-unset}" = "unset" && test "$${VAR3-unset}" = "unset" && test "$${VAR4-unset}" = "unset" && test "$${VAR5-unset}" = "unset"'
+ExecStart=bash -x -c 'test "$${VAR1-unset}" = "unset" && test "$${VAR2-unset}" = "unset" && test "$${VAR3-unset}" = "unset" && test "$${VAR4-unset}" = "unset" && test "$${VAR5-unset}" = "unset"'
 Type=oneshot
 PassEnvironment=VAR1 VAR2 VAR3 VAR4 VAR5
diff --git a/test/test-execute/exec-passenvironment-empty.service b/test/test-execute/exec-passenvironment-empty.service
index a5fd092783..21db61cbc1 100644
--- a/test/test-execute/exec-passenvironment-empty.service
+++ b/test/test-execute/exec-passenvironment-empty.service
@@ -3,7 +3,7 @@
 Description=Test for PassEnvironment and erasing the variable list
 
 [Service]
-ExecStart=sh -x -c 'test "$${VAR1-unset}" = "unset" && test "$${VAR2-unset}" = "unset" && test "$${VAR3-unset}" = "unset" && test "$${VAR4-unset}" = "unset" && test "$${VAR5-unset}" = "unset"'
+ExecStart=bash -x -c 'test "$${VAR1-unset}" = "unset" && test "$${VAR2-unset}" = "unset" && test "$${VAR3-unset}" = "unset" && test "$${VAR4-unset}" = "unset" && test "$${VAR5-unset}" = "unset"'
 Type=oneshot
 PassEnvironment=VAR1 VAR2 VAR3 VAR4 VAR5
 PassEnvironment=
diff --git a/test/test-execute/exec-passenvironment-repeated.service b/test/test-execute/exec-passenvironment-repeated.service
index f3b886c5c6..a2067a6aff 100644
--- a/test/test-execute/exec-passenvironment-repeated.service
+++ b/test/test-execute/exec-passenvironment-repeated.service
@@ -3,7 +3,7 @@
 Description=Test for PassEnvironment with a variable name repeated
 
 [Service]
-ExecStart=sh -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$VAR4" = "new\nline" && test "$$VAR5" = passwordwithbackslashes'
+ExecStart=bash -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$VAR4" = "new\nline" && test "$$VAR5" = passwordwithbackslashes'
 Type=oneshot
 PassEnvironment=VAR1 VAR2
 PassEnvironment=VAR1 VAR3
diff --git a/test/test-execute/exec-passenvironment.service b/test/test-execute/exec-passenvironment.service
index 1dcbcf97c8..5584aa3500 100644
--- a/test/test-execute/exec-passenvironment.service
+++ b/test/test-execute/exec-passenvironment.service
@@ -3,6 +3,6 @@
 Description=Test for PassEnvironment
 
 [Service]
-ExecStart=sh -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$VAR4" = "new\nline" && test "$$VAR5" = passwordwithbackslashes'
+ExecStart=bash -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$VAR4" = "new\nline" && test "$$VAR5" = passwordwithbackslashes'
 Type=oneshot
 PassEnvironment=VAR1 VAR2 VAR3 VAR4 VAR5
diff --git a/test/test-execute/exec-personality-aarch64.service b/test/test-execute/exec-personality-aarch64.service
index e4ea294dcc..72afaf386b 100644
--- a/test/test-execute/exec-personality-aarch64.service
+++ b/test/test-execute/exec-personality-aarch64.service
@@ -3,6 +3,6 @@
 Description=Test for Personality=aarch64
 
 [Service]
-ExecStart=sh -c 'echo $(uname -m); exit $(test $(uname -m) = "aarch64")'
+ExecStart=bash -c 'echo $(uname -m); exit $(test $(uname -m) = "aarch64")'
 Type=oneshot
 Personality=aarch64
diff --git a/test/test-execute/exec-personality-loongarch64.service b/test/test-execute/exec-personality-loongarch64.service
index 31c6b258c7..689f35ff9e 100644
--- a/test/test-execute/exec-personality-loongarch64.service
+++ b/test/test-execute/exec-personality-loongarch64.service
@@ -2,6 +2,6 @@
 Description=Test for Personality=loongarch64
 
 [Service]
-ExecStart=sh -c 'echo $(uname -m); exit $(test $(uname -m) = "loongarch64")'
+ExecStart=bash -c 'echo $(uname -m); exit $(test $(uname -m) = "loongarch64")'
 Type=oneshot
 Personality=loongarch64
diff --git a/test/test-execute/exec-personality-ppc64.service b/test/test-execute/exec-personality-ppc64.service
index dd83bf66ee..3377c6b823 100644
--- a/test/test-execute/exec-personality-ppc64.service
+++ b/test/test-execute/exec-personality-ppc64.service
@@ -3,6 +3,6 @@
 Description=Test for Personality=ppc64
 
 [Service]
-ExecStart=sh -c 'echo $(uname -m); exit $(test $(uname -m) = "ppc64")'
+ExecStart=bash -c 'echo $(uname -m); exit $(test $(uname -m) = "ppc64")'
 Type=oneshot
 Personality=ppc64
diff --git a/test/test-execute/exec-personality-ppc64le.service b/test/test-execute/exec-personality-ppc64le.service
index 3f19d825db..f38c31b4c4 100644
--- a/test/test-execute/exec-personality-ppc64le.service
+++ b/test/test-execute/exec-personality-ppc64le.service
@@ -3,6 +3,6 @@
 Description=Test for Personality=ppc64le
 
 [Service]
-ExecStart=sh -c 'echo $(uname -m); exit $(test $(uname -m) = "ppc64le")'
+ExecStart=bash -c 'echo $(uname -m); exit $(test $(uname -m) = "ppc64le")'
 Type=oneshot
 Personality=ppc64le
diff --git a/test/test-execute/exec-personality-s390.service b/test/test-execute/exec-personality-s390.service
index 7d120cde2d..d81b90bcd4 100644
--- a/test/test-execute/exec-personality-s390.service
+++ b/test/test-execute/exec-personality-s390.service
@@ -3,6 +3,6 @@
 Description=Test for Personality=s390
 
 [Service]
-ExecStart=sh -x -c 'c=$$(uname -m); test "$$c" = "s390"'
+ExecStart=bash -x -c 'c=$$(uname -m); test "$$c" = "s390"'
 Type=oneshot
 Personality=s390
diff --git a/test/test-execute/exec-personality-s390x.service b/test/test-execute/exec-personality-s390x.service
index 4545dee4c3..10bcd37b69 100644
--- a/test/test-execute/exec-personality-s390x.service
+++ b/test/test-execute/exec-personality-s390x.service
@@ -3,6 +3,6 @@
 Description=Test for Personality=s390x
 
 [Service]
-ExecStart=sh -x -c 'c=$$(uname -m); test "$$c" = "s390x"'
+ExecStart=bash -x -c 'c=$$(uname -m); test "$$c" = "s390x"'
 Type=oneshot
 Personality=s390x
diff --git a/test/test-execute/exec-personality-x86-64.service b/test/test-execute/exec-personality-x86-64.service
index e7b945ca14..d2324001b5 100644
--- a/test/test-execute/exec-personality-x86-64.service
+++ b/test/test-execute/exec-personality-x86-64.service
@@ -3,6 +3,6 @@
 Description=Test for Personality=x86-64
 
 [Service]
-ExecStart=sh -x -c 'c=$$(uname -m); test "$$c" = "x86_64"'
+ExecStart=bash -x -c 'c=$$(uname -m); test "$$c" = "x86_64"'
 Type=oneshot
 Personality=x86-64
diff --git a/test/test-execute/exec-personality-x86.service b/test/test-execute/exec-personality-x86.service
index 95ec353cb1..1245d0b482 100644
--- a/test/test-execute/exec-personality-x86.service
+++ b/test/test-execute/exec-personality-x86.service
@@ -3,6 +3,6 @@
 Description=Test for Personality=x86
 
 [Service]
-ExecStart=sh -x -c 'c=$$(uname -m); test "$$c" = "i686" -o "$$c" = "x86_64"'
+ExecStart=bash -x -c 'c=$$(uname -m); test "$$c" = "i686" -o "$$c" = "x86_64"'
 Type=oneshot
 Personality=x86
diff --git a/test/test-execute/exec-privatedevices-bind.service b/test/test-execute/exec-privatedevices-bind.service
index c2229a4a7a..a74a4435a4 100644
--- a/test/test-execute/exec-privatedevices-bind.service
+++ b/test/test-execute/exec-privatedevices-bind.service
@@ -3,8 +3,8 @@
 Description=Test for PrivateDevices=yes with a bind mounted device
 
 [Service]
-ExecStart=sh -c 'test -c /dev/kmsg'
-ExecStart=sh -c 'test ! -w /dev/'
+ExecStart=bash -c 'test -c /dev/kmsg'
+ExecStart=bash -c 'test ! -w /dev/'
 Type=oneshot
 PrivateDevices=yes
 BindPaths=/dev/kmsg
diff --git a/test/test-execute/exec-privatedevices-disabled-by-prefix.service b/test/test-execute/exec-privatedevices-disabled-by-prefix.service
index 8f09c4ab95..eeea0b9355 100644
--- a/test/test-execute/exec-privatedevices-disabled-by-prefix.service
+++ b/test/test-execute/exec-privatedevices-disabled-by-prefix.service
@@ -3,7 +3,7 @@
 Description=Test for PrivateDevices=yes with prefix
 
 [Service]
-ExecStart=sh -x -c '! test -c /dev/kmsg'
-ExecStart=+/bin/sh -x -c 'test -c /dev/kmsg'
+ExecStart=bash -x -c '! test -c /dev/kmsg'
+ExecStart=+bash -x -c 'test -c /dev/kmsg'
 Type=oneshot
 PrivateDevices=yes
diff --git a/test/test-execute/exec-privatedevices-no-capability-mknod.service b/test/test-execute/exec-privatedevices-no-capability-mknod.service
index 811f4ad685..dfdb5932b2 100644
--- a/test/test-execute/exec-privatedevices-no-capability-mknod.service
+++ b/test/test-execute/exec-privatedevices-no-capability-mknod.service
@@ -5,5 +5,5 @@ Description=Test CAP_MKNOD capability for PrivateDevices=no
 [Service]
 PrivateDevices=no
 # sed: remove dropped (cap_xxx-[epi]) and IAB capabilities from the output
-ExecStart=sh -x -c 'capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_mknod'
+ExecStart=bash -x -c 'capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_mknod'
 Type=oneshot
diff --git a/test/test-execute/exec-privatedevices-no-capability-sys-rawio.service b/test/test-execute/exec-privatedevices-no-capability-sys-rawio.service
index 47be622b5f..e756f83b7f 100644
--- a/test/test-execute/exec-privatedevices-no-capability-sys-rawio.service
+++ b/test/test-execute/exec-privatedevices-no-capability-sys-rawio.service
@@ -5,5 +5,5 @@ Description=Test CAP_SYS_RAWIO capability for PrivateDevices=no
 [Service]
 PrivateDevices=no
 # sed: remove dropped (cap_xxx-[epi]) and IAB capabilities from the output
-ExecStart=sh -x -c 'capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_sys_rawio'
+ExecStart=bash -x -c 'capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_sys_rawio'
 Type=oneshot
diff --git a/test/test-execute/exec-privatedevices-no.service b/test/test-execute/exec-privatedevices-no.service
index 5b8a05133b..c2b22b81c2 100644
--- a/test/test-execute/exec-privatedevices-no.service
+++ b/test/test-execute/exec-privatedevices-no.service
@@ -3,6 +3,6 @@
 Description=Test for PrivateDevices=no
 
 [Service]
-ExecStart=sh -x -c 'test -c /dev/kmsg'
+ExecStart=bash -x -c 'test -c /dev/kmsg'
 Type=oneshot
 PrivateDevices=no
diff --git a/test/test-execute/exec-privatedevices-yes-capability-mknod.service b/test/test-execute/exec-privatedevices-yes-capability-mknod.service
index 3d29a9cb05..b3b06af605 100644
--- a/test/test-execute/exec-privatedevices-yes-capability-mknod.service
+++ b/test/test-execute/exec-privatedevices-yes-capability-mknod.service
@@ -5,5 +5,5 @@ Description=Test CAP_MKNOD capability for PrivateDevices=yes
 [Service]
 PrivateDevices=yes
 # sed: remove dropped (cap_xxx-[epi]) and IAB capabilities from the output
-ExecStart=sh -x -c '! capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_mknod'
+ExecStart=bash -x -c '! capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_mknod'
 Type=oneshot
diff --git a/test/test-execute/exec-privatedevices-yes-capability-sys-rawio.service b/test/test-execute/exec-privatedevices-yes-capability-sys-rawio.service
index b1c0617837..4233d477a2 100644
--- a/test/test-execute/exec-privatedevices-yes-capability-sys-rawio.service
+++ b/test/test-execute/exec-privatedevices-yes-capability-sys-rawio.service
@@ -5,5 +5,5 @@ Description=Test CAP_SYS_RAWIO capability for PrivateDevices=yes
 [Service]
 PrivateDevices=yes
 # sed: remove dropped (cap_xxx-[epi]) and IAB capabilities from the output
-ExecStart=sh -x -c '! capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_sys_rawio'
+ExecStart=bash -x -c '! capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_sys_rawio'
 Type=oneshot
diff --git a/test/test-execute/exec-privatedevices-yes-with-group.service b/test/test-execute/exec-privatedevices-yes-with-group.service
index 094ac22724..bdd164348c 100644
--- a/test/test-execute/exec-privatedevices-yes-with-group.service
+++ b/test/test-execute/exec-privatedevices-yes-with-group.service
@@ -8,10 +8,10 @@ Group=daemon
 Type=oneshot
 
 # Check the group applied
-ExecStart=sh -x -c 'test "$$(id -n -g)" = "daemon"'
+ExecStart=bash -x -c 'test "$$(id -n -g)" = "daemon"'
 
 # Check that the namespace applied
-ExecStart=sh -c 'test ! -c /dev/kmsg'
+ExecStart=bash -c 'test ! -c /dev/kmsg'
 
 # Check that the owning group of a node is not daemon (should be the host root)
-ExecStart=sh -x -c 'test ! "$$(stat -c %%G /dev/stderr)" = "daemon"'
+ExecStart=bash -x -c 'test ! "$$(stat -c %%G /dev/stderr)" = "daemon"'
diff --git a/test/test-execute/exec-privatedevices-yes.service b/test/test-execute/exec-privatedevices-yes.service
index 2d32753053..349fd8f974 100644
--- a/test/test-execute/exec-privatedevices-yes.service
+++ b/test/test-execute/exec-privatedevices-yes.service
@@ -3,6 +3,6 @@
 Description=Test for PrivateDevices=yes
 
 [Service]
-ExecStart=sh -c 'test ! -c /dev/kmsg'
+ExecStart=bash -c 'test ! -c /dev/kmsg'
 Type=oneshot
 PrivateDevices=yes
diff --git a/test/test-execute/exec-privatenetwork-yes-privatemounts-no.service b/test/test-execute/exec-privatenetwork-yes-privatemounts-no.service
index c16102d07f..9c7f0a468e 100644
--- a/test/test-execute/exec-privatenetwork-yes-privatemounts-no.service
+++ b/test/test-execute/exec-privatenetwork-yes-privatemounts-no.service
@@ -3,10 +3,10 @@
 Description=Test for PrivateNetwork= without mount namespacing
 
 [Service]
-ExecStart=sh -x -c '! ip link show dummy-test-exec'
-ExecStart=sh -x -c 'test ! -e /proc/sys/net/ipv4/conf/dummy-test-exec'
+ExecStart=bash -x -c '! ip link show dummy-test-exec'
+ExecStart=bash -x -c 'test ! -e /proc/sys/net/ipv4/conf/dummy-test-exec'
 # Without mount namespacing, we can access the dummy-test-exec interface through sysfs
-ExecStart=sh -x -c 'test -d /sys/class/net/dummy-test-exec'
+ExecStart=bash -x -c 'test -d /sys/class/net/dummy-test-exec'
 Type=oneshot
 PrivateNetwork=yes
 PrivateMounts=no
diff --git a/test/test-execute/exec-privatenetwork-yes-privatemounts-yes.service b/test/test-execute/exec-privatenetwork-yes-privatemounts-yes.service
index eb48d6e0c5..2078eff0bd 100644
--- a/test/test-execute/exec-privatenetwork-yes-privatemounts-yes.service
+++ b/test/test-execute/exec-privatenetwork-yes-privatemounts-yes.service
@@ -3,10 +3,10 @@
 Description=Test for PrivateNetwork= with mount namespacing
 
 [Service]
-ExecStart=sh -x -c '! ip link show dummy-test-exec'
-ExecStart=sh -x -c 'test ! -e /proc/sys/net/ipv4/conf/dummy-test-exec'
+ExecStart=bash -x -c '! ip link show dummy-test-exec'
+ExecStart=bash -x -c 'test ! -e /proc/sys/net/ipv4/conf/dummy-test-exec'
 # With mount namespacing, we cannot access the dummy-test-exec interface through sysfs.
-ExecStart=sh -x -c 'test ! -e /sys/class/net/dummy-test-exec'
+ExecStart=bash -x -c 'test ! -e /sys/class/net/dummy-test-exec'
 Type=oneshot
 PrivateNetwork=yes
 # PrivateNetwork=yes implies PrivateMounts=yes
diff --git a/test/test-execute/exec-privatetmp-disabled-by-prefix.service b/test/test-execute/exec-privatetmp-disabled-by-prefix.service
index 9dfcecc02c..6437244520 100644
--- a/test/test-execute/exec-privatetmp-disabled-by-prefix.service
+++ b/test/test-execute/exec-privatetmp-disabled-by-prefix.service
@@ -3,7 +3,7 @@
 Description=Test for PrivateTmp=yes with prefix
 
 [Service]
-ExecStart=sh -x -c 'test ! -f /tmp/test-exec_privatetmp'
-ExecStart=+/bin/sh -x -c 'test -f /tmp/test-exec_privatetmp'
+ExecStart=bash -x -c 'test ! -f /tmp/test-exec_privatetmp'
+ExecStart=+bash -x -c 'test -f /tmp/test-exec_privatetmp'
 Type=oneshot
 PrivateTmp=yes
diff --git a/test/test-execute/exec-privatetmp-disconnected-after-and-requires-for-var.service b/test/test-execute/exec-privatetmp-disconnected-after-and-requires-for-var.service
index 39e49c698a..39594a768e 100644
--- a/test/test-execute/exec-privatetmp-disconnected-after-and-requires-for-var.service
+++ b/test/test-execute/exec-privatetmp-disconnected-after-and-requires-for-var.service
@@ -6,10 +6,10 @@ After=var.mount
 Requires=var.mount
 
 [Service]
-ExecStart=sh -x -c 'test ! -f /tmp/test-exec_privatetmp'
+ExecStart=bash -x -c 'test ! -f /tmp/test-exec_privatetmp'
 ExecStart=touch /tmp/test-exec_privatetmp_disconnected
 ExecStart=touch /var/tmp/test-exec_privatetmp_disconnected
-ExecStart=sh -x -c 'test x$$TMPDIR = x'
+ExecStart=bash -x -c 'test x$$TMPDIR = x'
 Type=oneshot
 ProtectSystem=strict
 PrivateTmp=disconnected
diff --git a/test/test-execute/exec-privatetmp-disconnected-after-and-wants-for-var.service b/test/test-execute/exec-privatetmp-disconnected-after-and-wants-for-var.service
index b11302f5f2..79553df7f1 100644
--- a/test/test-execute/exec-privatetmp-disconnected-after-and-wants-for-var.service
+++ b/test/test-execute/exec-privatetmp-disconnected-after-and-wants-for-var.service
@@ -6,10 +6,10 @@ After=var.mount
 Wants=var.mount
 
 [Service]
-ExecStart=sh -x -c 'test ! -f /tmp/test-exec_privatetmp'
+ExecStart=bash -x -c 'test ! -f /tmp/test-exec_privatetmp'
 ExecStart=touch /tmp/test-exec_privatetmp_disconnected
 ExecStart=touch /var/tmp/test-exec_privatetmp_disconnected
-ExecStart=sh -x -c 'test x$$TMPDIR = x'
+ExecStart=bash -x -c 'test x$$TMPDIR = x'
 Type=oneshot
 ProtectSystem=strict
 PrivateTmp=disconnected
diff --git a/test/test-execute/exec-privatetmp-disconnected-defaultdependencies-no.service b/test/test-execute/exec-privatetmp-disconnected-defaultdependencies-no.service
index 2208b8e1b5..2b8693796a 100644
--- a/test/test-execute/exec-privatetmp-disconnected-defaultdependencies-no.service
+++ b/test/test-execute/exec-privatetmp-disconnected-defaultdependencies-no.service
@@ -4,10 +4,10 @@ Description=Test for PrivateTmp=disconnected with DefaultDependencies=no
 DefaultDependencies=no
 
 [Service]
-ExecStart=sh -x -c 'test ! -f /tmp/test-exec_privatetmp'
+ExecStart=bash -x -c 'test ! -f /tmp/test-exec_privatetmp'
 ExecStart=touch /tmp/test-exec_privatetmp_disconnected
-ExecStart=sh -x -c '(! touch /var/tmp/test-exec_privatetmp_disconnected)'
-ExecStart=sh -x -c 'test $$TMPDIR = /tmp'
+ExecStart=bash -x -c '(! touch /var/tmp/test-exec_privatetmp_disconnected)'
+ExecStart=bash -x -c 'test $$TMPDIR = /tmp'
 Type=oneshot
 ProtectSystem=strict
 PrivateTmp=disconnected
diff --git a/test/test-execute/exec-privatetmp-disconnected-nodefaultdeps-nor-sandboxing.service b/test/test-execute/exec-privatetmp-disconnected-nodefaultdeps-nor-sandboxing.service
index 4bff9d03f1..6fb561d0c9 100644
--- a/test/test-execute/exec-privatetmp-disconnected-nodefaultdeps-nor-sandboxing.service
+++ b/test/test-execute/exec-privatetmp-disconnected-nodefaultdeps-nor-sandboxing.service
@@ -5,6 +5,6 @@ DefaultDependencies=no
 
 [Service]
 ExecStart=+touch /tmp/test-exec_privatetmp_disconnected
-ExecStart=+sh -x -c 'test x$$TMPDIR = x'
+ExecStart=+bash -x -c 'test x$$TMPDIR = x'
 Type=oneshot
 PrivateTmp=disconnected
diff --git a/test/test-execute/exec-privatetmp-disconnected-requires-mounts-for-var.service b/test/test-execute/exec-privatetmp-disconnected-requires-mounts-for-var.service
index 349c137984..58c3ee9499 100644
--- a/test/test-execute/exec-privatetmp-disconnected-requires-mounts-for-var.service
+++ b/test/test-execute/exec-privatetmp-disconnected-requires-mounts-for-var.service
@@ -5,10 +5,10 @@ DefaultDependencies=no
 RequiresMountsFor=/var/
 
 [Service]
-ExecStart=sh -x -c 'test ! -f /tmp/test-exec_privatetmp'
+ExecStart=bash -x -c 'test ! -f /tmp/test-exec_privatetmp'
 ExecStart=touch /tmp/test-exec_privatetmp_disconnected
 ExecStart=touch /var/tmp/test-exec_privatetmp_disconnected
-ExecStart=sh -x -c 'test x$$TMPDIR = x'
+ExecStart=bash -x -c 'test x$$TMPDIR = x'
 Type=oneshot
 ProtectSystem=strict
 PrivateTmp=disconnected
diff --git a/test/test-execute/exec-privatetmp-disconnected-wants-mounts-for-var.service b/test/test-execute/exec-privatetmp-disconnected-wants-mounts-for-var.service
index 09ac3495b8..66337df79a 100644
--- a/test/test-execute/exec-privatetmp-disconnected-wants-mounts-for-var.service
+++ b/test/test-execute/exec-privatetmp-disconnected-wants-mounts-for-var.service
@@ -5,10 +5,10 @@ DefaultDependencies=no
 WantsMountsFor=/var/
 
 [Service]
-ExecStart=sh -x -c 'test ! -f /tmp/test-exec_privatetmp'
+ExecStart=bash -x -c 'test ! -f /tmp/test-exec_privatetmp'
 ExecStart=touch /tmp/test-exec_privatetmp_disconnected
 ExecStart=touch /var/tmp/test-exec_privatetmp_disconnected
-ExecStart=sh -x -c 'test x$$TMPDIR = x'
+ExecStart=bash -x -c 'test x$$TMPDIR = x'
 Type=oneshot
 ProtectSystem=strict
 PrivateTmp=disconnected
diff --git a/test/test-execute/exec-privatetmp-disconnected.service b/test/test-execute/exec-privatetmp-disconnected.service
index fbee568d74..470e4828cf 100644
--- a/test/test-execute/exec-privatetmp-disconnected.service
+++ b/test/test-execute/exec-privatetmp-disconnected.service
@@ -3,10 +3,10 @@
 Description=Test for PrivateTmp=disconnected
 
 [Service]
-ExecStart=sh -x -c 'test ! -f /tmp/test-exec_privatetmp'
+ExecStart=bash -x -c 'test ! -f /tmp/test-exec_privatetmp'
 ExecStart=touch /tmp/test-exec_privatetmp_disconnected
 ExecStart=touch /var/tmp/test-exec_privatetmp_disconnected
-ExecStart=sh -x -c 'test x$$TMPDIR = x'
+ExecStart=bash -x -c 'test x$$TMPDIR = x'
 Type=oneshot
 ProtectSystem=strict
 PrivateTmp=disconnected
diff --git a/test/test-execute/exec-privatetmp-no.service b/test/test-execute/exec-privatetmp-no.service
index 599203abb8..4cf9104a64 100644
--- a/test/test-execute/exec-privatetmp-no.service
+++ b/test/test-execute/exec-privatetmp-no.service
@@ -3,6 +3,6 @@
 Description=Test for PrivateTmp=no
 
 [Service]
-ExecStart=sh -x -c 'test -f /tmp/test-exec_privatetmp'
+ExecStart=bash -x -c 'test -f /tmp/test-exec_privatetmp'
 Type=oneshot
 PrivateTmp=no
diff --git a/test/test-execute/exec-privatetmp-yes.service b/test/test-execute/exec-privatetmp-yes.service
index 5ea52639f0..df6ec3a816 100644
--- a/test/test-execute/exec-privatetmp-yes.service
+++ b/test/test-execute/exec-privatetmp-yes.service
@@ -3,6 +3,6 @@
 Description=Test for PrivateTmp=yes
 
 [Service]
-ExecStart=sh -x -c 'test ! -f /tmp/test-exec_privatetmp'
+ExecStart=bash -x -c 'test ! -f /tmp/test-exec_privatetmp'
 Type=oneshot
 PrivateTmp=yes
diff --git a/test/test-execute/exec-protecthome-tmpfs-vs-protectsystem-strict.service b/test/test-execute/exec-protecthome-tmpfs-vs-protectsystem-strict.service
index c51cacf40d..161acbcb12 100644
--- a/test/test-execute/exec-protecthome-tmpfs-vs-protectsystem-strict.service
+++ b/test/test-execute/exec-protecthome-tmpfs-vs-protectsystem-strict.service
@@ -7,4 +7,4 @@ Description=Test ProtectHome=tmpfs vs ProtectSystem=strict
 ProtectHome=tmpfs
 ProtectSystem=strict
 Type=oneshot
-ExecStart=sh -x -c 'test "$$(stat -fc %%T /home)" = "tmpfs"'
+ExecStart=bash -x -c 'test "$$(stat -fc %%T /home)" = "tmpfs"'
diff --git a/test/test-execute/exec-protectkernellogs-no-capabilities.service b/test/test-execute/exec-protectkernellogs-no-capabilities.service
index be64c58089..1ed350f4b1 100644
--- a/test/test-execute/exec-protectkernellogs-no-capabilities.service
+++ b/test/test-execute/exec-protectkernellogs-no-capabilities.service
@@ -5,5 +5,5 @@ Description=Test CAP_SYSLOG for ProtectKernelLogs=no
 [Service]
 ProtectKernelLogs=no
 # sed: remove dropped (cap_xxx-[epi]) and IAB capabilities from the output
-ExecStart=sh -x -c 'capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_syslog'
+ExecStart=bash -x -c 'capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_syslog'
 Type=oneshot
diff --git a/test/test-execute/exec-protectkernellogs-yes-capabilities.service b/test/test-execute/exec-protectkernellogs-yes-capabilities.service
index 646ff751a7..387a08af68 100644
--- a/test/test-execute/exec-protectkernellogs-yes-capabilities.service
+++ b/test/test-execute/exec-protectkernellogs-yes-capabilities.service
@@ -5,5 +5,5 @@ Description=Test CAP_SYSLOG for ProtectKernelLogs=yes
 [Service]
 ProtectKernelLogs=yes
 # sed: remove dropped (cap_xxx-[epi]) and IAB capabilities from the output
-ExecStart=sh -x -c '! capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_syslog'
+ExecStart=bash -x -c '! capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_syslog'
 Type=oneshot
diff --git a/test/test-execute/exec-protectkernelmodules-no-capabilities.service b/test/test-execute/exec-protectkernelmodules-no-capabilities.service
index cefdb60991..c34a474362 100644
--- a/test/test-execute/exec-protectkernelmodules-no-capabilities.service
+++ b/test/test-execute/exec-protectkernelmodules-no-capabilities.service
@@ -5,5 +5,5 @@ Description=Test CAP_SYS_MODULE ProtectKernelModules=no
 [Service]
 ProtectKernelModules=no
 # sed: remove dropped (cap_xxx-[epi]) and IAB capabilities from the output
-ExecStart=sh -x -c 'capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_sys_module'
+ExecStart=bash -x -c 'capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_sys_module'
 Type=oneshot
diff --git a/test/test-execute/exec-protectkernelmodules-yes-capabilities.service b/test/test-execute/exec-protectkernelmodules-yes-capabilities.service
index 1f327a28ab..cfd0ac1ff7 100644
--- a/test/test-execute/exec-protectkernelmodules-yes-capabilities.service
+++ b/test/test-execute/exec-protectkernelmodules-yes-capabilities.service
@@ -5,5 +5,5 @@ Description=Test CAP_SYS_MODULE for ProtectKernelModules=yes
 [Service]
 ProtectKernelModules=yes
 # sed: remove dropped (cap_xxx-[epi]) and IAB capabilities from the output
-ExecStart=sh -x -c '! capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_sys_module'
+ExecStart=bash -x -c '! capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_sys_module'
 Type=oneshot
diff --git a/test/test-execute/exec-protectkernelmodules-yes-mount-propagation.service b/test/test-execute/exec-protectkernelmodules-yes-mount-propagation.service
index 16399bd206..f134aac8af 100644
--- a/test/test-execute/exec-protectkernelmodules-yes-mount-propagation.service
+++ b/test/test-execute/exec-protectkernelmodules-yes-mount-propagation.service
@@ -4,5 +4,5 @@ Description=Test to make sure that passing ProtectKernelModules=yes disconnect m
 
 [Service]
 ProtectKernelModules=yes
-ExecStart=sh -x -c 'd=$$(mktemp -d -p /tmp); trap "umount \'$$d\' && rmdir \'$$d\'" EXIT; mount -t tmpfs tmpfs "$$d"; grep "$$d" /proc/self/mountinfo && ! grep "$$d" /proc/$${PPID}/mountinfo && ! grep "$$d" /proc/1/mountinfo'
+ExecStart=bash -x -c 'd=$$(mktemp -d -p /tmp); trap "umount \'$$d\' && rmdir \'$$d\'" EXIT; mount -t tmpfs tmpfs "$$d"; grep "$$d" /proc/self/mountinfo && ! grep "$$d" /proc/$${PPID}/mountinfo && ! grep "$$d" /proc/1/mountinfo'
 Type=oneshot
diff --git a/test/test-execute/exec-readonlypaths-mount-propagation.service b/test/test-execute/exec-readonlypaths-mount-propagation.service
index e896bac5fd..f3d1f2e7df 100644
--- a/test/test-execute/exec-readonlypaths-mount-propagation.service
+++ b/test/test-execute/exec-readonlypaths-mount-propagation.service
@@ -4,5 +4,5 @@ Description=Test to make sure that passing ReadOnlyPaths= disconnect mount propa
 
 [Service]
 ReadOnlyPaths=-/i-dont-exist
-ExecStart=sh -x -c 'd=$$(mktemp -d -p /tmp); trap "umount \'$$d\' && rmdir \'$$d\'" EXIT; mount -t tmpfs tmpfs "$$d"; grep "$$d" /proc/self/mountinfo && ! grep "$$d" /proc/$${PPID}/mountinfo && ! grep "$$d" /proc/1/mountinfo'
+ExecStart=bash -x -c 'd=$$(mktemp -d -p /tmp); trap "umount \'$$d\' && rmdir \'$$d\'" EXIT; mount -t tmpfs tmpfs "$$d"; grep "$$d" /proc/self/mountinfo && ! grep "$$d" /proc/$${PPID}/mountinfo && ! grep "$$d" /proc/1/mountinfo'
 Type=oneshot
diff --git a/test/test-execute/exec-readonlypaths-simple.service b/test/test-execute/exec-readonlypaths-simple.service
index 80e6c83bf7..53ba315770 100644
--- a/test/test-execute/exec-readonlypaths-simple.service
+++ b/test/test-execute/exec-readonlypaths-simple.service
@@ -5,8 +5,8 @@ Description=Test for ReadOnlyPaths=
 [Service]
 Type=oneshot
 # This should work, as we explicitly disable the effect of ReadOnlyPaths=
-ExecStart=+/bin/sh -c 'touch /tmp/thisisasimpletest'
+ExecStart=+bash -c 'touch /tmp/thisisasimpletest'
 # This should also work, as we do not disable the effect of ReadOnlyPaths= but invert the exit code
-ExecStart=sh -x -c '! touch /tmp/thisisasimpletest'
-ExecStart=+/bin/sh -c 'rm /tmp/thisisasimpletest'
+ExecStart=bash -x -c '! touch /tmp/thisisasimpletest'
+ExecStart=+bash -c 'rm /tmp/thisisasimpletest'
 ReadOnlyPaths=/tmp
diff --git a/test/test-execute/exec-readonlypaths-with-bindpaths.service b/test/test-execute/exec-readonlypaths-with-bindpaths.service
index 7a183672c7..2879e3d079 100644
--- a/test/test-execute/exec-readonlypaths-with-bindpaths.service
+++ b/test/test-execute/exec-readonlypaths-with-bindpaths.service
@@ -5,5 +5,5 @@ Description=Test for ReadOnlyPaths=
 [Service]
 ReadOnlyPaths=/etc -/i-dont-exist /usr
 BindPaths=/etc:/tmp/etc2
-ExecStart=sh -x -c 'test ! -w /etc && test ! -w /usr && test ! -e /i-dont-exist && test -w /var'
+ExecStart=bash -x -c 'test ! -w /etc && test ! -w /usr && test ! -e /i-dont-exist && test -w /var'
 Type=oneshot
diff --git a/test/test-execute/exec-readonlypaths.service b/test/test-execute/exec-readonlypaths.service
index a0eff8bcec..b1a1e43d5f 100644
--- a/test/test-execute/exec-readonlypaths.service
+++ b/test/test-execute/exec-readonlypaths.service
@@ -5,6 +5,6 @@ Description=Test for ReadOnlyPaths=
 [Service]
 ReadOnlyPaths=/usr /etc /sys /dev -/i-dont-exist
 PrivateDevices=yes
-ExecStart=sh -x -c 'test ! -w /usr && test ! -w /etc && test ! -w /sys && test ! -w /sys/fs/cgroup'
-ExecStart=sh -x -c 'test ! -w /dev && test ! -w /dev/shm && test ! -e /i-dont-exist && test -w /var'
+ExecStart=bash -x -c 'test ! -w /usr && test ! -w /etc && test ! -w /sys && test ! -w /sys/fs/cgroup'
+ExecStart=bash -x -c 'test ! -w /dev && test ! -w /dev/shm && test ! -e /i-dont-exist && test -w /var'
 Type=oneshot
diff --git a/test/test-execute/exec-readwritepaths-mount-propagation.service b/test/test-execute/exec-readwritepaths-mount-propagation.service
index 9b844cf433..e203d13493 100644
--- a/test/test-execute/exec-readwritepaths-mount-propagation.service
+++ b/test/test-execute/exec-readwritepaths-mount-propagation.service
@@ -4,5 +4,5 @@ Description=Test to make sure that passing ReadWritePaths= disconnect mount prop
 
 [Service]
 ReadWritePaths=-/i-dont-exist
-ExecStart=sh -x -c 'd=$$(mktemp -d -p /tmp); trap "umount \'$$d\' && rmdir \'$$d\'" EXIT; mount -t tmpfs tmpfs "$$d"; grep "$$d" /proc/self/mountinfo && ! grep "$$d" /proc/$${PPID}/mountinfo && ! grep "$$d" /proc/1/mountinfo'
+ExecStart=bash -x -c 'd=$$(mktemp -d -p /tmp); trap "umount \'$$d\' && rmdir \'$$d\'" EXIT; mount -t tmpfs tmpfs "$$d"; grep "$$d" /proc/self/mountinfo && ! grep "$$d" /proc/$${PPID}/mountinfo && ! grep "$$d" /proc/1/mountinfo'
 Type=oneshot
diff --git a/test/test-execute/exec-restrictnamespaces-merge-and.service b/test/test-execute/exec-restrictnamespaces-merge-and.service
index fdeb3f140d..ca99dba412 100644
--- a/test/test-execute/exec-restrictnamespaces-merge-and.service
+++ b/test/test-execute/exec-restrictnamespaces-merge-and.service
@@ -6,5 +6,5 @@ Description=Test merging RestrictNamespaces= with AND
 RestrictNamespaces=mnt pid
 RestrictNamespaces=~mnt usr
 ExecStart=unshare -p -f
-ExecStart=sh -c '! unshare -m -u -i -n'
+ExecStart=bash -c '! unshare -m -u -i -n'
 Type=oneshot
diff --git a/test/test-execute/exec-restrictnamespaces-merge-or.service b/test/test-execute/exec-restrictnamespaces-merge-or.service
index fca3718c9d..0e2dff296e 100644
--- a/test/test-execute/exec-restrictnamespaces-merge-or.service
+++ b/test/test-execute/exec-restrictnamespaces-merge-or.service
@@ -6,5 +6,5 @@ Description=Test merging RestrictNamespaces= with OR
 RestrictNamespaces=mnt pid
 RestrictNamespaces=mnt uts
 ExecStart=unshare -m -u -p -f
-ExecStart=sh -c '! unshare -u -i -n'
+ExecStart=bash -c '! unshare -u -i -n'
 Type=oneshot
diff --git a/test/test-execute/exec-runtimedirectory-mode.service b/test/test-execute/exec-runtimedirectory-mode.service
index e75e0d2380..c99ac37516 100644
--- a/test/test-execute/exec-runtimedirectory-mode.service
+++ b/test/test-execute/exec-runtimedirectory-mode.service
@@ -3,8 +3,8 @@
 Description=Test for RuntimeDirectoryMode
 
 [Service]
-ExecStart=sh -x -c 'mode=$$(stat -c %%a %t/test-exec_runtimedirectory-mode); test "$$mode" = "750"'
-ExecStart=sh -x -c 'test "$$RUNTIME_DIRECTORY" = "%t/test-exec_runtimedirectory-mode"'
+ExecStart=bash -x -c 'mode=$$(stat -c %%a %t/test-exec_runtimedirectory-mode); test "$$mode" = "750"'
+ExecStart=bash -x -c 'test "$$RUNTIME_DIRECTORY" = "%t/test-exec_runtimedirectory-mode"'
 Type=oneshot
 RuntimeDirectory=test-exec_runtimedirectory-mode
 RuntimeDirectoryMode=0750
diff --git a/test/test-execute/exec-runtimedirectory-owner-nfsnobody.service b/test/test-execute/exec-runtimedirectory-owner-nfsnobody.service
index 4bc336167c..a08a5fdfc4 100644
--- a/test/test-execute/exec-runtimedirectory-owner-nfsnobody.service
+++ b/test/test-execute/exec-runtimedirectory-owner-nfsnobody.service
@@ -3,7 +3,7 @@
 Description=Test for RuntimeDirectory owner (must not be the default group of the user if Group is set)
 
 [Service]
-ExecStart=sh -x -c 'group=$$(stat -c %%G %t/test-exec_runtimedirectory-owner); test "$$group" = "nfsnobody"'
+ExecStart=bash -x -c 'group=$$(stat -c %%G %t/test-exec_runtimedirectory-owner); test "$$group" = "nfsnobody"'
 Type=oneshot
 Group=nfsnobody
 User=root
diff --git a/test/test-execute/exec-runtimedirectory-owner-nobody.service b/test/test-execute/exec-runtimedirectory-owner-nobody.service
index 5f94bf9cd0..11afe7f57e 100644
--- a/test/test-execute/exec-runtimedirectory-owner-nobody.service
+++ b/test/test-execute/exec-runtimedirectory-owner-nobody.service
@@ -3,7 +3,7 @@
 Description=Test for RuntimeDirectory owner (must not be the default group of the user if Group is set)
 
 [Service]
-ExecStart=sh -x -c 'group=$$(stat -c %%G %t/test-exec_runtimedirectory-owner); test "$$group" = "nobody"'
+ExecStart=bash -x -c 'group=$$(stat -c %%G %t/test-exec_runtimedirectory-owner); test "$$group" = "nobody"'
 Type=oneshot
 Group=nobody
 User=root
diff --git a/test/test-execute/exec-runtimedirectory-owner-nogroup.service b/test/test-execute/exec-runtimedirectory-owner-nogroup.service
index 6d508959f8..134e84ef0b 100644
--- a/test/test-execute/exec-runtimedirectory-owner-nogroup.service
+++ b/test/test-execute/exec-runtimedirectory-owner-nogroup.service
@@ -3,7 +3,7 @@
 Description=Test for RuntimeDirectory owner (must not be the default group of the user if Group is set)
 
 [Service]
-ExecStart=sh -x -c 'group=$$(stat -c %%G %t/test-exec_runtimedirectory-owner); test "$$group" = "nogroup"'
+ExecStart=bash -x -c 'group=$$(stat -c %%G %t/test-exec_runtimedirectory-owner); test "$$group" = "nogroup"'
 Type=oneshot
 Group=nogroup
 User=root
diff --git a/test/test-execute/exec-runtimedirectory-owner.service b/test/test-execute/exec-runtimedirectory-owner.service
index 64d66b302e..38d581b205 100644
--- a/test/test-execute/exec-runtimedirectory-owner.service
+++ b/test/test-execute/exec-runtimedirectory-owner.service
@@ -3,7 +3,7 @@
 Description=Test for RuntimeDirectory owner (must not be the default group of the user if Group is set)
 
 [Service]
-ExecStart=sh -x -c 'group=$$(stat -c %%G %t/test-exec_runtimedirectory-owner-daemon); test "$$group" = "daemon"'
+ExecStart=bash -x -c 'group=$$(stat -c %%G %t/test-exec_runtimedirectory-owner-daemon); test "$$group" = "daemon"'
 Type=oneshot
 Group=daemon
 User=root
diff --git a/test/test-execute/exec-runtimedirectory.service b/test/test-execute/exec-runtimedirectory.service
index f60110a485..1e23d6aec5 100644
--- a/test/test-execute/exec-runtimedirectory.service
+++ b/test/test-execute/exec-runtimedirectory.service
@@ -3,9 +3,9 @@
 Description=Test for RuntimeDirectory
 
 [Service]
-ExecStart=sh -x -c 'test -d %t/test-exec_runtimedirectory'
-ExecStart=sh -x -c 'test -d %t/test-exec_runtimedirectory2/hogehoge'
-ExecStart=sh -x -c 'test "$$RUNTIME_DIRECTORY" = "%t/test-exec_runtimedirectory:%t/test-exec_runtimedirectory2/hogehoge"'
+ExecStart=bash -x -c 'test -d %t/test-exec_runtimedirectory'
+ExecStart=bash -x -c 'test -d %t/test-exec_runtimedirectory2/hogehoge'
+ExecStart=bash -x -c 'test "$$RUNTIME_DIRECTORY" = "%t/test-exec_runtimedirectory:%t/test-exec_runtimedirectory2/hogehoge"'
 Type=oneshot
 RuntimeDirectory=test-exec_runtimedirectory
 RuntimeDirectory=./test-exec_runtimedirectory2///./hogehoge/.
diff --git a/test/test-execute/exec-set-credential.service b/test/test-execute/exec-set-credential.service
index 7f2e87f658..ac33095cdf 100644
--- a/test/test-execute/exec-set-credential.service
+++ b/test/test-execute/exec-set-credential.service
@@ -3,8 +3,8 @@
 Description=Test for SetCredential=
 
 [Service]
-ExecStart=sh -x -c 'test "$$(cat %d/test-execute.set-credential)" = "hoge"'
-ExecStartPost=sh -x -c 'test "$$(cat %d/test-execute.set-credential)" = "hoge"'
+ExecStart=bash -x -c 'test "$$(cat %d/test-execute.set-credential)" = "hoge"'
+ExecStartPost=bash -x -c 'test "$$(cat %d/test-execute.set-credential)" = "hoge"'
 ExecStop=bash -x -c '[[ ! -v CREDENTIALS_DIRECTORY ]]'
 ExecStopPost=bash -x -c '[[ ! -v CREDENTIALS_DIRECTORY ]]'
 Type=oneshot
diff --git a/test/test-execute/exec-specifier-user.service b/test/test-execute/exec-specifier-user.service
index ab565fb4fb..6bbc9c8953 100644
--- a/test/test-execute/exec-specifier-user.service
+++ b/test/test-execute/exec-specifier-user.service
@@ -4,8 +4,8 @@ Description=Test for specifiers
 
 [Service]
 Type=oneshot
-ExecStart=sh -c 'test %t = $$XDG_RUNTIME_DIR'
-ExecStart=sh -c 'test %S = %h/.local/state'
-ExecStart=sh -c 'test %C = %h/.cache'
-ExecStart=sh -c 'test %L = %h/.local/state/log'
-ExecStart=sh -c 'test %E = %h/.config'
+ExecStart=bash -c 'test %t = $$XDG_RUNTIME_DIR'
+ExecStart=bash -c 'test %S = %h/.local/state'
+ExecStart=bash -c 'test %C = %h/.cache'
+ExecStart=bash -c 'test %L = %h/.local/state/log'
+ExecStart=bash -c 'test %E = %h/.config'
diff --git a/test/test-execute/exec-specifier.service b/test/test-execute/exec-specifier.service
index 512f786f83..d4c23b3ace 100644
--- a/test/test-execute/exec-specifier.service
+++ b/test/test-execute/exec-specifier.service
@@ -16,12 +16,12 @@ ExecStart=test %f = /exec/specifier
 ExecStart=test %T = /tmp
 ExecStart=test %V = /var/tmp
 ExecStart=test %d = %t/credentials/%n
-ExecStart=sh -c 'test %u = $$(id -un)'
-ExecStart=sh -c 'test %U = $$(id -u)'
-ExecStart=sh -c 'test %g = $$(id -gn)'
-ExecStart=sh -c 'test %G = $$(id -g)'
+ExecStart=bash -c 'test %u = $$(id -un)'
+ExecStart=bash -c 'test %U = $$(id -u)'
+ExecStart=bash -c 'test %g = $$(id -gn)'
+ExecStart=bash -c 'test %G = $$(id -g)'
 ExecStart=test %h = /root
-ExecStart=sh -c 'test -x %s'
-ExecStart=sh -c 'test %b = $$(cat /proc/sys/kernel/random/boot_id | sed -e 's/-//g')'
-ExecStart=sh -c 'test %H = $$(uname -n)'
-ExecStart=sh -c 'test %v = $$(uname -r)'
+ExecStart=bash -c 'test -x %s'
+ExecStart=bash -c 'test %b = $$(cat /proc/sys/kernel/random/boot_id | sed -e 's/-//g')'
+ExecStart=bash -c 'test %H = $$(uname -n)'
+ExecStart=bash -c 'test %v = $$(uname -r)'
diff --git a/test/test-execute/exec-specifier@.service b/test/test-execute/exec-specifier@.service
index cb9d0a182a..4e630a711e 100644
--- a/test/test-execute/exec-specifier@.service
+++ b/test/test-execute/exec-specifier@.service
@@ -13,12 +13,12 @@ ExecStart=test %I = foo/bar
 ExecStart=test %j = specifier
 ExecStart=test %J = specifier
 ExecStart=test %f = /foo/bar
-ExecStart=sh -c 'test %u = $$(id -un)'
-ExecStart=sh -c 'test %U = $$(id -u)'
-ExecStart=sh -c 'test %g = $$(id -gn)'
-ExecStart=sh -c 'test %G = $$(id -g)'
+ExecStart=bash -c 'test %u = $$(id -un)'
+ExecStart=bash -c 'test %U = $$(id -u)'
+ExecStart=bash -c 'test %g = $$(id -gn)'
+ExecStart=bash -c 'test %G = $$(id -g)'
 ExecStart=test %h = /root
-ExecStart=sh -c 'test -x %s'
-ExecStart=sh -c 'test %b = $$(cat /proc/sys/kernel/random/boot_id | sed -e 's/-//g')'
-ExecStart=sh -c 'test %H = $$(uname -n)'
-ExecStart=sh -c 'test %v = $$(uname -r)'
+ExecStart=bash -c 'test -x %s'
+ExecStart=bash -c 'test %b = $$(cat /proc/sys/kernel/random/boot_id | sed -e 's/-//g')'
+ExecStart=bash -c 'test %H = $$(uname -n)'
+ExecStart=bash -c 'test %v = $$(uname -r)'
diff --git a/test/test-execute/exec-standardinput-data.service b/test/test-execute/exec-standardinput-data.service
index fd56f7e37b..cac9439304 100644
--- a/test/test-execute/exec-standardinput-data.service
+++ b/test/test-execute/exec-standardinput-data.service
@@ -3,7 +3,7 @@
 Description=Test for StandardInputText= and StandardInputData=
 
 [Service]
-ExecStart=sh -x -c 'd=$$(mktemp -d -p /tmp); echo -e "this is a test\nand this is more\nsomething encoded!\nsomething   in multiple lines\nand some more\nand a more bas64 data\nsomething with strange\nembedded\tcharacters\nand something with a exec-stdin-data.service specifier" >$d/text ; cmp $d/text ; rm -rf $d'
+ExecStart=bash -x -c 'd=$$(mktemp -d -p /tmp); echo -e "this is a test\nand this is more\nsomething encoded!\nsomething   in multiple lines\nand some more\nand a more bas64 data\nsomething with strange\nembedded\tcharacters\nand something with a exec-stdin-data.service specifier" >$d/text ; cmp $d/text ; rm -rf $d'
 Type=oneshot
 StandardInput=data
 StandardInputText=this is a test
diff --git a/test/test-execute/exec-standardoutput-append.service b/test/test-execute/exec-standardoutput-append.service
index 45d29ecfdd..563d3eba77 100644
--- a/test/test-execute/exec-standardoutput-append.service
+++ b/test/test-execute/exec-standardoutput-append.service
@@ -3,8 +3,8 @@
 Description=Test for StandardOutput=append:
 
 [Service]
-ExecStartPre=sh -c 'printf "hello\n" >/tmp/test-exec-standardoutput-output'
-ExecStartPre=sh -c 'printf "hello\nhello\n" >/tmp/test-exec-standardoutput-expected'
+ExecStartPre=bash -c 'printf "hello\n" >/tmp/test-exec-standardoutput-output'
+ExecStartPre=bash -c 'printf "hello\nhello\n" >/tmp/test-exec-standardoutput-expected'
 StandardInput=data
 StandardInputText=hello
 StandardOutput=append:/tmp/test-exec-standardoutput-output
diff --git a/test/test-execute/exec-standardoutput-file.service b/test/test-execute/exec-standardoutput-file.service
index 8b689a2494..6d14b359a3 100644
--- a/test/test-execute/exec-standardoutput-file.service
+++ b/test/test-execute/exec-standardoutput-file.service
@@ -3,8 +3,8 @@
 Description=Test for StandardOutput=file:
 
 [Service]
-ExecStartPre=sh -c 'printf "nooo\nhello\n" >/tmp/test-exec-standardoutput-output'
-ExecStartPre=sh -c 'printf "hello\nello\n" >/tmp/test-exec-standardoutput-expected'
+ExecStartPre=bash -c 'printf "nooo\nhello\n" >/tmp/test-exec-standardoutput-output'
+ExecStartPre=bash -c 'printf "hello\nello\n" >/tmp/test-exec-standardoutput-expected'
 StandardInput=data
 StandardInputText=hello
 StandardOutput=file:/tmp/test-exec-standardoutput-output
diff --git a/test/test-execute/exec-standardoutput-truncate.service b/test/test-execute/exec-standardoutput-truncate.service
index 1a86d92d8b..4be9022a38 100644
--- a/test/test-execute/exec-standardoutput-truncate.service
+++ b/test/test-execute/exec-standardoutput-truncate.service
@@ -3,11 +3,11 @@
 Description=Test for StandardOutput=truncate:
 
 [Service]
-ExecStartPre=sh -c 'printf "hello\n" >/tmp/test-exec-standardoutput-output'
-ExecStartPre=sh -c 'printf "hi\n" >/tmp/test-exec-standardoutput-expected'
+ExecStartPre=bash -c 'printf "hello\n" >/tmp/test-exec-standardoutput-output'
+ExecStartPre=bash -c 'printf "hi\n" >/tmp/test-exec-standardoutput-expected'
 StandardInput=data
 StandardInputText=hi
 StandardOutput=truncate:/tmp/test-exec-standardoutput-output
 StandardError=null
-ExecStart=sh -c 'cat && cmp /tmp/test-exec-standardoutput-output /tmp/test-exec-standardoutput-expected'
+ExecStart=bash -c 'cat && cmp /tmp/test-exec-standardoutput-output /tmp/test-exec-standardoutput-expected'
 Type=oneshot
diff --git a/test/test-execute/exec-supplementarygroups-multiple-groups-default-group-user.service b/test/test-execute/exec-supplementarygroups-multiple-groups-default-group-user.service
index 3c90124818..a46a760c0c 100644
--- a/test/test-execute/exec-supplementarygroups-multiple-groups-default-group-user.service
+++ b/test/test-execute/exec-supplementarygroups-multiple-groups-default-group-user.service
@@ -3,9 +3,9 @@
 Description=Test for Supplementary Group with multiple groups without Group and User
 
 [Service]
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "%G" && exit 0; done; exit 1'
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "2" && exit 0; done; exit 1'
-ExecStart=sh -x -c 'test "$$(id -g)" = "%G" && test "$$(id -u)" = "%U"'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "%G" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "2" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'test "$$(id -g)" = "%G" && test "$$(id -u)" = "%U"'
 Type=oneshot
 SupplementaryGroups=1 2
diff --git a/test/test-execute/exec-supplementarygroups-multiple-groups-withgid.service b/test/test-execute/exec-supplementarygroups-multiple-groups-withgid.service
index 0fd1c62052..c597fbce79 100644
--- a/test/test-execute/exec-supplementarygroups-multiple-groups-withgid.service
+++ b/test/test-execute/exec-supplementarygroups-multiple-groups-withgid.service
@@ -3,9 +3,9 @@
 Description=Test for Supplementary Group with multiple groups and Group=1
 
 [Service]
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "2" && exit 0; done; exit 1'
-ExecStart=sh -x -c 'test "$$(id -g)" = "1" && test "$$(id -u)" = "%U"'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "2" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'test "$$(id -g)" = "1" && test "$$(id -u)" = "%U"'
 Type=oneshot
 Group=1
 SupplementaryGroups=1 2
diff --git a/test/test-execute/exec-supplementarygroups-multiple-groups-withuid.service b/test/test-execute/exec-supplementarygroups-multiple-groups-withuid.service
index c430e54685..8149612b8d 100644
--- a/test/test-execute/exec-supplementarygroups-multiple-groups-withuid.service
+++ b/test/test-execute/exec-supplementarygroups-multiple-groups-withuid.service
@@ -3,8 +3,8 @@
 Description=Test for Supplementary Group with multiple groups and Uid=1
 
 [Service]
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "2" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "2" && exit 0; done; exit 1'
 Type=oneshot
 User=1
 SupplementaryGroups=1 2
diff --git a/test/test-execute/exec-supplementarygroups-single-group-user.service b/test/test-execute/exec-supplementarygroups-single-group-user.service
index 20a3561d08..00c29bf24b 100644
--- a/test/test-execute/exec-supplementarygroups-single-group-user.service
+++ b/test/test-execute/exec-supplementarygroups-single-group-user.service
@@ -3,8 +3,8 @@
 Description=Test for Supplementary Group with only one group and uid 1
 
 [Service]
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
-ExecStart=sh -x -c 'test "$$(id -g)" = "1" && test "$$(id -u)" = "1"'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'test "$$(id -g)" = "1" && test "$$(id -u)" = "1"'
 Type=oneshot
 User=1
 Group=1
diff --git a/test/test-execute/exec-supplementarygroups-single-group.service b/test/test-execute/exec-supplementarygroups-single-group.service
index 8c812573e4..99c821bf59 100644
--- a/test/test-execute/exec-supplementarygroups-single-group.service
+++ b/test/test-execute/exec-supplementarygroups-single-group.service
@@ -3,8 +3,8 @@
 Description=Test for Supplementary Group with only one group
 
 [Service]
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
-ExecStart=sh -x -c 'test "$$(id -g)" = "1" && test "$$(id -u)" = "0"'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'test "$$(id -g)" = "1" && test "$$(id -u)" = "0"'
 Type=oneshot
 Group=1
 SupplementaryGroups=1
diff --git a/test/test-execute/exec-supplementarygroups.service b/test/test-execute/exec-supplementarygroups.service
index 0a3d370595..a147cc79f4 100644
--- a/test/test-execute/exec-supplementarygroups.service
+++ b/test/test-execute/exec-supplementarygroups.service
@@ -3,7 +3,7 @@
 Description=Test for Supplementary Group
 
 [Service]
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "%G" && exit 0; done; exit 1'
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "%G" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
 Type=oneshot
 SupplementaryGroups=1
diff --git a/test/test-execute/exec-systemcallfilter-failing.service b/test/test-execute/exec-systemcallfilter-failing.service
index 7437d30108..800e6ede0c 100644
--- a/test/test-execute/exec-systemcallfilter-failing.service
+++ b/test/test-execute/exec-systemcallfilter-failing.service
@@ -3,7 +3,7 @@
 Description=Test for SystemCallFilter
 
 [Service]
-ExecStart=sh -c '/bin/echo "This should not be seen"'
+ExecStart=bash -c '/bin/echo "This should not be seen"'
 Type=oneshot
 LimitCORE=0
 SystemCallFilter=ioperm
diff --git a/test/test-execute/exec-systemcallfilter-failing2.service b/test/test-execute/exec-systemcallfilter-failing2.service
index 92672d1eb1..1738ee93a1 100644
--- a/test/test-execute/exec-systemcallfilter-failing2.service
+++ b/test/test-execute/exec-systemcallfilter-failing2.service
@@ -3,7 +3,7 @@
 Description=Test for SystemCallFilter
 
 [Service]
-ExecStart=sh -c '/bin/echo "This should not be seen"'
+ExecStart=bash -c '/bin/echo "This should not be seen"'
 Type=oneshot
 LimitCORE=0
 SystemCallFilter=~write open execve fexecve execveat exit_group close mmap munmap fstat DONOTEXIST
diff --git a/test/test-execute/exec-systemcallfilter-failing3.service b/test/test-execute/exec-systemcallfilter-failing3.service
index 4e7b81214b..9e27c80400 100644
--- a/test/test-execute/exec-systemcallfilter-failing3.service
+++ b/test/test-execute/exec-systemcallfilter-failing3.service
@@ -3,7 +3,7 @@
 Description=Test for SystemCallFilter
 
 [Service]
-ExecStart=sh -c '/bin/echo "This should not be seen"'
+ExecStart=bash -c '/bin/echo "This should not be seen"'
 Type=oneshot
 LimitCORE=0
 SystemCallArchitectures=native
diff --git a/test/test-execute/exec-systemcallfilter-nonewprivileges-bounding1.service b/test/test-execute/exec-systemcallfilter-nonewprivileges-bounding1.service
index eaa75dfb61..e8ab9b715a 100644
--- a/test/test-execute/exec-systemcallfilter-nonewprivileges-bounding1.service
+++ b/test/test-execute/exec-systemcallfilter-nonewprivileges-bounding1.service
@@ -3,7 +3,7 @@
 Description=Test bounding set is right with SystemCallFilter and non-root user
 
 [Service]
-ExecStart=sh -x -c 'c=$$(capsh --print | grep "Bounding set "); test "$$c" = "Bounding set =cap_net_bind_service"'
+ExecStart=bash -x -c 'c=$$(capsh --print | grep "Bounding set "); test "$$c" = "Bounding set =cap_net_bind_service"'
 Type=oneshot
 User=1
 SystemCallFilter=@system-service
diff --git a/test/test-execute/exec-systemcallfilter-nonewprivileges-bounding2.service b/test/test-execute/exec-systemcallfilter-nonewprivileges-bounding2.service
index fd0e3a259d..a5734fee69 100644
--- a/test/test-execute/exec-systemcallfilter-nonewprivileges-bounding2.service
+++ b/test/test-execute/exec-systemcallfilter-nonewprivileges-bounding2.service
@@ -3,7 +3,7 @@
 Description=Test bounding set is right with SystemCallFilter and non-root user
 
 [Service]
-ExecStart=sh -x -c 'c=$$(capsh --print | grep "Bounding set "); test "$$c" = "Bounding set =cap_setpcap,cap_net_bind_service,cap_sys_admin"'
+ExecStart=bash -x -c 'c=$$(capsh --print | grep "Bounding set "); test "$$c" = "Bounding set =cap_setpcap,cap_net_bind_service,cap_sys_admin"'
 Type=oneshot
 User=1
 SystemCallFilter=@system-service
diff --git a/test/test-execute/exec-systemcallfilter-nonewprivileges-protectclock.service b/test/test-execute/exec-systemcallfilter-nonewprivileges-protectclock.service
index 76b028c82c..64a6b2adbe 100644
--- a/test/test-execute/exec-systemcallfilter-nonewprivileges-protectclock.service
+++ b/test/test-execute/exec-systemcallfilter-nonewprivileges-protectclock.service
@@ -3,7 +3,7 @@
 Description=Test no_new_privs is unset for ProtectClock and non-root user
 
 [Service]
-ExecStart=sh -x -c 'c=$$(cat /proc/self/status | grep "NoNewPrivs:	"); test "$$c" = "NoNewPrivs:	0"'
+ExecStart=bash -x -c 'c=$$(cat /proc/self/status | grep "NoNewPrivs:	"); test "$$c" = "NoNewPrivs:	0"'
 Type=oneshot
 User=1
 ProtectClock=yes
diff --git a/test/test-execute/exec-systemcallfilter-nonewprivileges.service b/test/test-execute/exec-systemcallfilter-nonewprivileges.service
index 2091b71db0..fcae37adc7 100644
--- a/test/test-execute/exec-systemcallfilter-nonewprivileges.service
+++ b/test/test-execute/exec-systemcallfilter-nonewprivileges.service
@@ -3,7 +3,7 @@
 Description=Test no_new_privs is unset for SystemCallFilter and non-root user
 
 [Service]
-ExecStart=sh -x -c 'c=$$(cat /proc/self/status | grep "NoNewPrivs:	"); test "$$c" = "NoNewPrivs:	0"'
+ExecStart=bash -x -c 'c=$$(cat /proc/self/status | grep "NoNewPrivs:	"); test "$$c" = "NoNewPrivs:	0"'
 Type=oneshot
 User=1
 SystemCallFilter=@system-service
diff --git a/test/test-execute/exec-systemcallfilter-not-failing.service b/test/test-execute/exec-systemcallfilter-not-failing.service
index bb2ea55166..ad72b57927 100644
--- a/test/test-execute/exec-systemcallfilter-not-failing.service
+++ b/test/test-execute/exec-systemcallfilter-not-failing.service
@@ -3,7 +3,7 @@
 Description=Test for SystemCallFilter
 
 [Service]
-ExecStart=sh -c 'echo "Foo bar"'
+ExecStart=bash -c 'echo "Foo bar"'
 Type=oneshot
 SystemCallFilter=~read write open execve ioperm
 SystemCallFilter=ioctl
diff --git a/test/test-execute/exec-systemcallfilter-not-failing2.service b/test/test-execute/exec-systemcallfilter-not-failing2.service
index d9f0a3717c..f69998a8e8 100644
--- a/test/test-execute/exec-systemcallfilter-not-failing2.service
+++ b/test/test-execute/exec-systemcallfilter-not-failing2.service
@@ -3,6 +3,6 @@
 Description=Test for SystemCallFilter
 
 [Service]
-ExecStart=sh -c 'echo "Foo bar"'
+ExecStart=bash -c 'echo "Foo bar"'
 Type=oneshot
 SystemCallFilter=
diff --git a/test/test-execute/exec-systemcallfilter-not-failing3.service b/test/test-execute/exec-systemcallfilter-not-failing3.service
index df4e662d40..9e7ef6da4d 100644
--- a/test/test-execute/exec-systemcallfilter-not-failing3.service
+++ b/test/test-execute/exec-systemcallfilter-not-failing3.service
@@ -3,7 +3,7 @@
 Description=Test for SystemCallFilter
 
 [Service]
-ExecStart=sh -c 'echo "Foo bar"'
+ExecStart=bash -c 'echo "Foo bar"'
 Type=oneshot
 SystemCallArchitectures=native
 SystemCallFilter=
diff --git a/test/test-execute/exec-systemcallfilter-system-user-nfsnobody.service b/test/test-execute/exec-systemcallfilter-system-user-nfsnobody.service
index 19122869b1..6e97854068 100644
--- a/test/test-execute/exec-systemcallfilter-system-user-nfsnobody.service
+++ b/test/test-execute/exec-systemcallfilter-system-user-nfsnobody.service
@@ -3,7 +3,7 @@
 Description=Test for SystemCallFilter in system mode with User set
 
 [Service]
-ExecStart=sh -c 'echo "Foo bar"'
+ExecStart=bash -c 'echo "Foo bar"'
 Type=oneshot
 User=nfsnobody
 SystemCallFilter=~read write open execve ioperm
diff --git a/test/test-execute/exec-systemcallfilter-system-user-nobody.service b/test/test-execute/exec-systemcallfilter-system-user-nobody.service
index 0c2ebdd83e..133ff9335a 100644
--- a/test/test-execute/exec-systemcallfilter-system-user-nobody.service
+++ b/test/test-execute/exec-systemcallfilter-system-user-nobody.service
@@ -3,7 +3,7 @@
 Description=Test for SystemCallFilter in system mode with User set
 
 [Service]
-ExecStart=sh -c 'echo "Foo bar"'
+ExecStart=bash -c 'echo "Foo bar"'
 Type=oneshot
 User=nobody
 SystemCallFilter=~read write open execve ioperm
diff --git a/test/test-execute/exec-systemcallfilter-system-user.service b/test/test-execute/exec-systemcallfilter-system-user.service
index 6de39642e9..729ea4c9d8 100644
--- a/test/test-execute/exec-systemcallfilter-system-user.service
+++ b/test/test-execute/exec-systemcallfilter-system-user.service
@@ -3,7 +3,7 @@
 Description=Test for SystemCallFilter in system mode with User set (daemon)
 
 [Service]
-ExecStart=sh -c 'echo "Foo bar"'
+ExecStart=bash -c 'echo "Foo bar"'
 Type=oneshot
 User=daemon
 SystemCallFilter=~read write open execve ioperm
diff --git a/test/test-execute/exec-temporaryfilesystem-options.service b/test/test-execute/exec-temporaryfilesystem-options.service
index b00030131e..a767b95308 100644
--- a/test/test-execute/exec-temporaryfilesystem-options.service
+++ b/test/test-execute/exec-temporaryfilesystem-options.service
@@ -10,8 +10,8 @@ Type=oneshot
 TemporaryFileSystem=/var:ro,mode=0700,nostrictatime
 
 # Check /proc/self/mountinfo
-ExecStart=sh -x -c 'test "$$(awk \'$$5 == "/var" && $$11 !~ /(^|,)mode=700(,|$$)/ { print $$6 }\' /proc/self/mountinfo)" = ""'
+ExecStart=bash -x -c 'test "$$(awk \'$$5 == "/var" && $$11 !~ /(^|,)mode=700(,|$$)/ { print $$6 }\' /proc/self/mountinfo)" = ""'
 
-ExecStart=sh -x -c 'test "$$(awk \'$$5 == "/var" && $$6 !~ /(^|,)ro(,|$$)/ { print $$6 }\' /proc/self/mountinfo)" = ""'
-ExecStart=sh -x -c 'test "$$(awk \'$$5 == "/var" && $$6 !~ /(^|,)nodev(,|$$)/ { print $$6 }\' /proc/self/mountinfo)" = ""'
-ExecStart=sh -x -c 'test "$$(awk \'$$5 == "/var" && $$6 ~ /(^|,)strictatime(,|$$)/ { print $$6 }\' /proc/self/mountinfo)" = ""'
+ExecStart=bash -x -c 'test "$$(awk \'$$5 == "/var" && $$6 !~ /(^|,)ro(,|$$)/ { print $$6 }\' /proc/self/mountinfo)" = ""'
+ExecStart=bash -x -c 'test "$$(awk \'$$5 == "/var" && $$6 !~ /(^|,)nodev(,|$$)/ { print $$6 }\' /proc/self/mountinfo)" = ""'
+ExecStart=bash -x -c 'test "$$(awk \'$$5 == "/var" && $$6 ~ /(^|,)strictatime(,|$$)/ { print $$6 }\' /proc/self/mountinfo)" = ""'
diff --git a/test/test-execute/exec-temporaryfilesystem-ro.service b/test/test-execute/exec-temporaryfilesystem-ro.service
index 0a4b0f2552..6735278252 100644
--- a/test/test-execute/exec-temporaryfilesystem-ro.service
+++ b/test/test-execute/exec-temporaryfilesystem-ro.service
@@ -6,31 +6,31 @@ Description=Test for TemporaryFileSystem with read-only mode
 Type=oneshot
 
 # Check directories exist
-ExecStart=sh -c 'test -d /var/test-exec-temporaryfilesystem/rw && test -d /var/test-exec-temporaryfilesystem/ro'
+ExecStart=bash -c 'test -d /var/test-exec-temporaryfilesystem/rw && test -d /var/test-exec-temporaryfilesystem/ro'
 
 # Check TemporaryFileSystem= are empty
-ExecStart=sh -c 'for i in $$(ls -A /var); do test $$i = test-exec-temporaryfilesystem || false; done'
+ExecStart=bash -c 'for i in $$(ls -A /var); do test $$i = test-exec-temporaryfilesystem || false; done'
 
 # Check default mode
-ExecStart=sh -x -c 'test "$$(stat -c %%a /var)" = "755"'
+ExecStart=bash -x -c 'test "$$(stat -c %%a /var)" = "755"'
 
 # Cannot create a file in /var
-ExecStart=sh -c '! touch /var/hoge'
+ExecStart=bash -c '! touch /var/hoge'
 
 # Create a file in /var/test-exec-temporaryfilesystem/rw
-ExecStart=sh -c 'touch /var/test-exec-temporaryfilesystem/rw/thisisasimpletest-temporaryfilesystem'
+ExecStart=bash -c 'touch /var/test-exec-temporaryfilesystem/rw/thisisasimpletest-temporaryfilesystem'
 
 # Then, the file can be access through /tmp
-ExecStart=sh -c 'test -f /tmp/thisisasimpletest-temporaryfilesystem'
+ExecStart=bash -c 'test -f /tmp/thisisasimpletest-temporaryfilesystem'
 
 # Also, through /var/test-exec-temporaryfilesystem/ro
-ExecStart=sh -c 'test -f /var/test-exec-temporaryfilesystem/ro/thisisasimpletest-temporaryfilesystem'
+ExecStart=bash -c 'test -f /var/test-exec-temporaryfilesystem/ro/thisisasimpletest-temporaryfilesystem'
 
 # The file cannot modify through /var/test-exec-temporaryfilesystem/ro
-ExecStart=sh -c '! touch /var/test-exec-temporaryfilesystem/ro/thisisasimpletest-temporaryfilesystem'
+ExecStart=bash -c '! touch /var/test-exec-temporaryfilesystem/ro/thisisasimpletest-temporaryfilesystem'
 
 # Cleanup
-ExecStart=sh -c 'rm /tmp/thisisasimpletest-temporaryfilesystem'
+ExecStart=bash -c 'rm /tmp/thisisasimpletest-temporaryfilesystem'
 
 TemporaryFileSystem=/var:ro
 BindPaths=/tmp:/var/test-exec-temporaryfilesystem/rw
diff --git a/test/test-execute/exec-temporaryfilesystem-rw.service b/test/test-execute/exec-temporaryfilesystem-rw.service
index ff0aa048d4..48a0b2d613 100644
--- a/test/test-execute/exec-temporaryfilesystem-rw.service
+++ b/test/test-execute/exec-temporaryfilesystem-rw.service
@@ -9,10 +9,10 @@ Type=oneshot
 ExecStart=test -d /var/test-exec-temporaryfilesystem/rw -a -d /var/test-exec-temporaryfilesystem/ro
 
 # Check TemporaryFileSystem= are empty
-ExecStart=sh -c 'for i in $$(ls -A /var); do test $$i = test-exec-temporaryfilesystem || false; done'
+ExecStart=bash -c 'for i in $$(ls -A /var); do test $$i = test-exec-temporaryfilesystem || false; done'
 
 # Check default mode
-ExecStart=sh -x -c 'test "$$(stat -c %%a /var)" = "755"'
+ExecStart=bash -x -c 'test "$$(stat -c %%a /var)" = "755"'
 
 # Create a file in /var
 ExecStart=touch /var/hoge
@@ -27,7 +27,7 @@ ExecStart=test -f /tmp/thisisasimpletest-temporaryfilesystem
 ExecStart=test -f /var/test-exec-temporaryfilesystem/ro/thisisasimpletest-temporaryfilesystem
 
 # The file cannot modify through /var/test-exec-temporaryfilesystem/ro
-ExecStart=sh -c '! touch /var/test-exec-temporaryfilesystem/ro/thisisasimpletest-temporaryfilesystem'
+ExecStart=bash -c '! touch /var/test-exec-temporaryfilesystem/ro/thisisasimpletest-temporaryfilesystem'
 
 # Cleanup
 ExecStart=rm /tmp/thisisasimpletest-temporaryfilesystem
diff --git a/test/test-execute/exec-temporaryfilesystem-usr.service b/test/test-execute/exec-temporaryfilesystem-usr.service
index 455344e114..cae1b8b074 100644
--- a/test/test-execute/exec-temporaryfilesystem-usr.service
+++ b/test/test-execute/exec-temporaryfilesystem-usr.service
@@ -6,11 +6,11 @@ Description=Test for TemporaryFileSystem on /usr
 Type=oneshot
 
 # Check TemporaryFileSystem= are empty
-ExecStart=sh -c 'for i in $$(ls -A /usr); do test $$i = lib -o $$i = lib64 -o $$i = bin -o $$i = sbin || false; done'
+ExecStart=bash -c 'for i in $$(ls -A /usr); do test $$i = lib -o $$i = lib64 -o $$i = bin -o $$i = sbin || false; done'
 
 # Cannot create files under /usr
-ExecStart=sh -c '! touch /usr/hoge'
-ExecStart=sh -c '! touch /usr/bin/hoge'
+ExecStart=bash -c '! touch /usr/hoge'
+ExecStart=bash -c '! touch /usr/bin/hoge'
 
 TemporaryFileSystem=/usr:ro
 BindReadOnlyPaths=-/usr/lib -/usr/lib64 /usr/bin /usr/sbin
diff --git a/test/test-execute/exec-umask-0177.service b/test/test-execute/exec-umask-0177.service
index de9ac5a233..c8835af473 100644
--- a/test/test-execute/exec-umask-0177.service
+++ b/test/test-execute/exec-umask-0177.service
@@ -3,7 +3,7 @@
 Description=Test for UMask
 
 [Service]
-ExecStart=sh -x -c 'rm /tmp/test-exec-umask; touch /tmp/test-exec-umask; mode=$$(stat -c %%a /tmp/test-exec-umask); test "$$mode" = "600"'
+ExecStart=bash -x -c 'rm /tmp/test-exec-umask; touch /tmp/test-exec-umask; mode=$$(stat -c %%a /tmp/test-exec-umask); test "$$mode" = "600"'
 Type=oneshot
 UMask=0177
 PrivateTmp=yes
diff --git a/test/test-execute/exec-umask-default.service b/test/test-execute/exec-umask-default.service
index 6d13c0bfa2..f44f94b2b1 100644
--- a/test/test-execute/exec-umask-default.service
+++ b/test/test-execute/exec-umask-default.service
@@ -3,6 +3,6 @@
 Description=Test for UMask default
 
 [Service]
-ExecStart=sh -x -c 'rm /tmp/test-exec-umask; touch /tmp/test-exec-umask; mode=$$(stat -c %%a /tmp/test-exec-umask); test "$$mode" = "644"'
+ExecStart=bash -x -c 'rm /tmp/test-exec-umask; touch /tmp/test-exec-umask; mode=$$(stat -c %%a /tmp/test-exec-umask); test "$$mode" = "644"'
 Type=oneshot
 PrivateTmp=yes
diff --git a/test/test-execute/exec-unsetenvironment.service b/test/test-execute/exec-unsetenvironment.service
index 9c5e277d05..e64e261072 100644
--- a/test/test-execute/exec-unsetenvironment.service
+++ b/test/test-execute/exec-unsetenvironment.service
@@ -3,7 +3,7 @@
 Description=Test for UnsetEnvironment
 
 [Service]
-ExecStart=sh -x -c 'test "$$FOO" = "bar" && test "$${QUUX-X}" = "X" && test "$$VAR3" = "value3" && test "$${VAR4-X}" = "X" && test "$$VAR5" = "value5" && test "$${X%b-X}" = "X"'
+ExecStart=bash -x -c 'test "$$FOO" = "bar" && test "$${QUUX-X}" = "X" && test "$$VAR3" = "value3" && test "$${VAR4-X}" = "X" && test "$$VAR5" = "value5" && test "$${X%b-X}" = "X"'
 Type=oneshot
 Environment=FOO=bar QUUX=waldo VAR3=value3 VAR4=value4 VAR5=value5 X%b=%U
 UnsetEnvironment=QUUX=waldo VAR3=somethingelse VAR4 X%b=%U
diff --git a/test/test-execute/exec-user-nfsnobody.service b/test/test-execute/exec-user-nfsnobody.service
index 1ce5f08370..aa6a3cca87 100644
--- a/test/test-execute/exec-user-nfsnobody.service
+++ b/test/test-execute/exec-user-nfsnobody.service
@@ -3,6 +3,6 @@
 Description=Test for User
 
 [Service]
-ExecStart=sh -x -c 'test "$$USER" = "nfsnobody"'
+ExecStart=bash -x -c 'test "$$USER" = "nfsnobody"'
 Type=oneshot
 User=nfsnobody
diff --git a/test/test-execute/exec-user-nobody.service b/test/test-execute/exec-user-nobody.service
index 003b873b39..f5f79540bd 100644
--- a/test/test-execute/exec-user-nobody.service
+++ b/test/test-execute/exec-user-nobody.service
@@ -3,6 +3,6 @@
 Description=Test for User
 
 [Service]
-ExecStart=sh -x -c 'test "$$USER" = "nobody"'
+ExecStart=bash -x -c 'test "$$USER" = "nobody"'
 Type=oneshot
 User=nobody
diff --git a/test/test-execute/exec-user.service b/test/test-execute/exec-user.service
index 696c7e5739..c0335b74fa 100644
--- a/test/test-execute/exec-user.service
+++ b/test/test-execute/exec-user.service
@@ -3,6 +3,6 @@
 Description=Test for User (daemon)
 
 [Service]
-ExecStart=sh -x -c 'test "$$USER" = "daemon"'
+ExecStart=bash -x -c 'test "$$USER" = "daemon"'
 Type=oneshot
 User=daemon
diff --git a/test/test-execute/exec-workingdirectory-trailing-dot.service b/test/test-execute/exec-workingdirectory-trailing-dot.service
index 3c4869d858..6fb9fd490f 100644
--- a/test/test-execute/exec-workingdirectory-trailing-dot.service
+++ b/test/test-execute/exec-workingdirectory-trailing-dot.service
@@ -3,6 +3,6 @@
 Description=Test for WorkingDirectory with trailing dot
 
 [Service]
-ExecStart=sh -x -c 'test "$$PWD" = "/tmp/test-exec_workingdirectory"'
+ExecStart=bash -x -c 'test "$$PWD" = "/tmp/test-exec_workingdirectory"'
 Type=oneshot
 WorkingDirectory=/tmp///./test-exec_workingdirectory/.
diff --git a/test/test-execute/exec-workingdirectory.service b/test/test-execute/exec-workingdirectory.service
index 4c40fafcf1..937b957988 100644
--- a/test/test-execute/exec-workingdirectory.service
+++ b/test/test-execute/exec-workingdirectory.service
@@ -3,6 +3,6 @@
 Description=Test for WorkingDirectory
 
 [Service]
-ExecStart=sh -x -c 'test "$$PWD" = "/tmp/test-exec_workingdirectory"'
+ExecStart=bash -x -c 'test "$$PWD" = "/tmp/test-exec_workingdirectory"'
 Type=oneshot
 WorkingDirectory=/tmp/test-exec_workingdirectory
diff --git a/test/test-network/systemd-networkd-tests.py b/test/test-network/systemd-networkd-tests.py
index 67d7ccbb62..6477510e11 100755
--- a/test/test-network/systemd-networkd-tests.py
+++ b/test/test-network/systemd-networkd-tests.py
@@ -432,7 +432,8 @@ def save_active_units():
             'systemd-resolved-varlink.socket',
             'systemd-resolved.service',
             'systemd-timesyncd.service',
-            'firewalld.service'
+            'firewalld.service',
+            'nftables.service',
     ]:
         if call(f'systemctl is-active --quiet {u}') == 0:
             call(f'systemctl stop {u}')
@@ -8922,7 +8923,7 @@ class NetworkdDHCPPDTests(unittest.TestCase, Utilities):
 
         self.teardown_nftset('addr6', 'network6', 'ifindex')
 
-    def verify_dhcp4_6rd(self, tunnel_name, address_prefix, border_router):
+    def verify_dhcp4_6rd(self, tunnel_name, address_prefix, address_prefix_re, border_router):
         print('### ip -4 address show dev veth-peer scope global')
         output = check_output('ip -4 address show dev veth-peer scope global')
         print(output)
@@ -9087,7 +9088,7 @@ class NetworkdDHCPPDTests(unittest.TestCase, Utilities):
         output = check_output(f'ip -6 address show dev {tunnel_name}')
         print(output)
         self.assertRegex(output, 'inet6 2001:db8:6464:[0-9a-f]+0[23]:[0-9a-f]*:[0-9a-f]*:[0-9a-f]*:[0-9a-f]*/64 (metric 256 |)scope global dynamic')
-        self.assertRegex(output, fr'inet6 ::{address_prefix}[0-9]+/96 scope global')
+        self.assertRegex(output, fr'inet6 ::{address_prefix_re}/96 scope global')
 
         print(f'### ip -6 route show dev {tunnel_name}')
         output = check_output(f'ip -6 route show dev {tunnel_name}')
@@ -9099,7 +9100,7 @@ class NetworkdDHCPPDTests(unittest.TestCase, Utilities):
         output = check_output('ip -6 route show default')
         print(output)
         self.assertIn('default', output)
-        self.assertIn(f'via ::{border_router} dev {tunnel_name}', output)
+        self.assertRegex(output, fr'via ::{border_router} dev {tunnel_name}')
 
     def test_dhcp4_6rd(self):
         def get_dhcp_6rd_prefix(link):
@@ -9159,13 +9160,13 @@ class NetworkdDHCPPDTests(unittest.TestCase, Utilities):
 
         self.wait_online(f'{tunnel_name}:routable')
 
-        self.verify_dhcp4_6rd(tunnel_name, '10.100.100.1', '10.0.0.1')
+        self.verify_dhcp4_6rd(tunnel_name, '10.100.100.1', '(10.100.100.1[0-9][0-9]|a64:64[6-9a-c][0-9a-f])', '(10.0.0.1|a00:1)')
 
         # Test case for reconfigure
         networkctl_reconfigure('dummy98', 'dummy99')
         self.wait_online('dummy98:routable', 'dummy99:degraded')
 
-        self.verify_dhcp4_6rd(tunnel_name, '10.100.100.1', '10.0.0.1')
+        self.verify_dhcp4_6rd(tunnel_name, '10.100.100.1', '(10.100.100.1[0-9][0-9]|a64:64[6-9a-c][0-9a-f])', '(10.0.0.1|a00:1)')
 
         # Change the address range and (border) router, then if check the same tunnel is reused.
         stop_dnsmasq()
@@ -9179,7 +9180,7 @@ class NetworkdDHCPPDTests(unittest.TestCase, Utilities):
         self.wait_online('veth99:routable', 'test1:routable', 'dummy97:routable', 'dummy98:routable', 'dummy99:degraded',
                          'veth97:routable', 'veth97-peer:routable', 'veth98:routable', 'veth98-peer:routable')
 
-        self.verify_dhcp4_6rd(tunnel_name, '10.100.100.2', '10.0.0.2')
+        self.verify_dhcp4_6rd(tunnel_name, '10.100.100.2', '(10.100.100.2[0-5][0-9]|a64:64[c-f][0-9a-f])', '(10.0.0.2|a00:2)')
 
 class NetworkdIPv6PrefixTests(unittest.TestCase, Utilities):
 
diff --git a/test/test-udev.py b/test/test-udev.py
index 68c48fd790..49695ef739 100755
--- a/test/test-udev.py
+++ b/test/test-udev.py
@@ -596,7 +596,7 @@ RULES = [
             not_exp_links   = ["foo3", "foo4", "foo5", "foo6", "foo7", "foo8"],
         ),
         rules = r"""
-        SUBSYSTEMS=="scsi", PROGRAM=="/bin/sh -c 'echo foo3 foo4 foo5 foo6 foo7 foo8 foo9 | sed  s/foo9/bar9/'", KERNEL=="sda5", SYMLINK+="%c{7}"
+        SUBSYSTEMS=="scsi", PROGRAM=="/bin/bash -c 'echo foo3 foo4 foo5 foo6 foo7 foo8 foo9 | sed  s/foo9/bar9/'", KERNEL=="sda5", SYMLINK+="%c{7}"
         """),
 
     Rules.new(
@@ -618,7 +618,7 @@ RULES = [
             not_exp_links   = ["foo1"],
         ),
         rules = r"""
-        SUBSYSTEMS=="scsi", PROGRAM=="/bin/sh -c 'printf %%s \"foo1 foo2\" | grep \"foo1 foo2\"'", KERNEL=="sda5", SYMLINK+="%c{2}"
+        SUBSYSTEMS=="scsi", PROGRAM=="/bin/bash -c 'printf %%s \"foo1 foo2\" | grep \"foo1 foo2\"'", KERNEL=="sda5", SYMLINK+="%c{2}"
         """),
 
     Rules.new(
@@ -629,7 +629,7 @@ RULES = [
             not_exp_links   = ["foo1"],
         ),
         rules = r"""
-SUBSYSTEMS=="scsi", PROGRAM=="/bin/sh -c \"printf %%s 'foo1 foo2' | grep 'foo1 foo2'\"", KERNEL=="sda5", SYMLINK+="%c{2}"
+SUBSYSTEMS=="scsi", PROGRAM=="/bin/bash -c \"printf %%s 'foo1 foo2' | grep 'foo1 foo2'\"", KERNEL=="sda5", SYMLINK+="%c{2}"
         """),
 
     Rules.new(
@@ -640,7 +640,7 @@ SUBSYSTEMS=="scsi", PROGRAM=="/bin/sh -c \"printf %%s 'foo1 foo2' | grep 'foo1 f
             not_exp_links   = ["foo1", "foo3"],
         ),
         rules = r"""
-        SUBSYSTEMS=="scsi", PROGRAM=="/bin/sh -c 'printf \"%%s %%s\" \"foo1 foo2\" \"foo3\"| grep \"foo1 foo2\"'", KERNEL=="sda5", SYMLINK+="%c{2}"
+        SUBSYSTEMS=="scsi", PROGRAM=="/bin/bash -c 'printf \"%%s %%s\" \"foo1 foo2\" \"foo3\"| grep \"foo1 foo2\"'", KERNEL=="sda5", SYMLINK+="%c{2}"
         """),
 
     Rules.new(
diff --git a/test/units/TEST-02-UNITTESTS.sh b/test/units/TEST-02-UNITTESTS.sh
index dec727f804..ee5eab08d5 100755
--- a/test/units/TEST-02-UNITTESTS.sh
+++ b/test/units/TEST-02-UNITTESTS.sh
@@ -3,12 +3,22 @@
 set -eux
 set -o pipefail
 
+# shellcheck source=test/units/util.sh
+. "$(dirname "$0")"/util.sh
+
 if ! systemd-detect-virt -qc && [[ "${TEST_CMDLINE_NEWLINE:-}" != bar ]]; then
     cat /proc/cmdline
     echo >&2 "Expected TEST_CMDLINE_NEWLINE=bar from the kernel command line"
     exit 1
 fi
 
+if built_with_musl; then
+    SYSTEMD_LIBC=musl
+else
+    SYSTEMD_LIBC=glibc
+fi
+export SYSTEMD_LIBC
+
 if [[ -z "${TEST_MATCH_SUBTEST:-}" ]]; then
     # If we're running with TEST_PREFER_NSPAWN=1 limit the set of tests we run
     # in QEMU to only those that can't run in a container to avoid running
@@ -66,6 +76,7 @@ run_test() {
         --property Delegate=1 \
         --property EnvironmentFile=-/usr/lib/systemd/systemd-asan-env \
         --property "Environment=$environment" \
+        --setenv SYSTEMD_LIBC \
         --unit="$name" \
         --wait "$test" && ret=0 || ret=$?
 
diff --git a/test/units/TEST-03-JOBS.sh b/test/units/TEST-03-JOBS.sh
index 4b8b67bd57..6f7494ef2f 100755
--- a/test/units/TEST-03-JOBS.sh
+++ b/test/units/TEST-03-JOBS.sh
@@ -73,13 +73,13 @@ cat <<EOF >/run/systemd/system/wait2.service
 [Unit]
 Description=Wait for 2 seconds
 [Service]
-ExecStart=sh -ec 'sleep 2'
+ExecStart=bash -ec 'sleep 2'
 EOF
 cat <<EOF >/run/systemd/system/wait5fail.service
 [Unit]
 Description=Wait for 5 seconds and fail
 [Service]
-ExecStart=sh -ec 'sleep 5; false'
+ExecStart=bash -ec 'sleep 5; false'
 EOF
 
 # wait2 succeeds
diff --git a/test/units/TEST-04-JOURNAL.journal.sh b/test/units/TEST-04-JOURNAL.journal.sh
index 5473da1de8..5d2ee3a049 100755
--- a/test/units/TEST-04-JOURNAL.journal.sh
+++ b/test/units/TEST-04-JOURNAL.journal.sh
@@ -93,7 +93,7 @@ grep -vq "^_PID=$PID" /tmp/output
 # https://github.com/systemd/systemd/issues/15654
 ID=$(systemd-id128 new)
 printf "This will\nusually fail\nand be truncated\n" >/tmp/expected
-systemd-cat -t "$ID" sh -c 'env echo -n "This will";echo;env echo -n "usually fail";echo;env echo -n "and be truncated";echo;'
+systemd-cat -t "$ID" bash -c 'env echo -n "This will"; echo; env echo -n "usually fail"; echo; env echo -n "and be truncated"; echo;'
 journalctl --sync
 journalctl -b -o cat -t "$ID" >/tmp/output
 diff /tmp/expected /tmp/output
@@ -221,7 +221,7 @@ journalctl --follow --merge | head -n1 | grep .
 rm -f /tmp/issue-26746-log /tmp/issue-26746-cursor
 ID="$(systemd-id128 new)"
 journalctl -t "$ID" --follow --cursor-file=/tmp/issue-26746-cursor | tee /tmp/issue-26746-log &
-systemd-cat -t "$ID" sh -c 'echo hogehoge'
+systemd-cat -t "$ID" bash -c 'echo hogehoge'
 # shellcheck disable=SC2016
 timeout 10 bash -c 'until [[ -f /tmp/issue-26746-log && "$(cat /tmp/issue-26746-log)" =~ hogehoge ]]; do sleep .5; done'
 pkill -TERM journalctl
diff --git a/test/units/TEST-07-PID1.delegate-namespaces.sh b/test/units/TEST-07-PID1.delegate-namespaces.sh
index 3fd1287fb2..68ade8fc41 100755
--- a/test/units/TEST-07-PID1.delegate-namespaces.sh
+++ b/test/units/TEST-07-PID1.delegate-namespaces.sh
@@ -39,8 +39,8 @@ testcase_pid() {
     # MountAPIVFS=yes always bind mounts child mounts of APIVFS filesystems, which means /proc/sys is always read-only
     # so we can't write to it when running in a container.
     if ! systemd-detect-virt --container; then
-        (! systemd-run -p PrivateUsersEx=self -p PrivatePIDs=yes -p MountAPIVFS=yes --wait --pipe -- sh -c 'echo 5 >/proc/sys/kernel/ns_last_pid')
-        systemd-run -p PrivateUsersEx=self -p PrivatePIDs=yes -p MountAPIVFS=yes -p DelegateNamespaces=pid --wait --pipe -- sh -c 'echo 5 >/proc/sys/kernel/ns_last_pid'
+        (! systemd-run -p PrivateUsersEx=self -p PrivatePIDs=yes -p MountAPIVFS=yes --wait --pipe -- bash -c 'echo 5 >/proc/sys/kernel/ns_last_pid')
+        systemd-run -p PrivateUsersEx=self -p PrivatePIDs=yes -p MountAPIVFS=yes -p DelegateNamespaces=pid --wait --pipe -- bash -c 'echo 5 >/proc/sys/kernel/ns_last_pid'
     fi
 }
 
diff --git a/test/units/TEST-07-PID1.exec-context.sh b/test/units/TEST-07-PID1.exec-context.sh
index 2ec7f018e8..d6255e21cd 100755
--- a/test/units/TEST-07-PID1.exec-context.sh
+++ b/test/units/TEST-07-PID1.exec-context.sh
@@ -356,7 +356,7 @@ systemd-run \
     -p DynamicUser=yes \
     -p EnvironmentFile=-/usr/lib/systemd/systemd-asan-env \
     -p NotifyAccess=all \
-    sh -c 'touch /tmp/a && touch /var/tmp/b && ! test -f /tmp/b && ! test -f /var/tmp/a && systemd-notify --ready && sleep infinity'
+    bash -c 'touch /tmp/a && touch /var/tmp/b && ! test -f /tmp/b && ! test -f /var/tmp/a && systemd-notify --ready && sleep infinity'
 (! ls /tmp/systemd-private-"$(tr -d '-' < /proc/sys/kernel/random/boot_id)"-test-07-dynamic-user-tmp.service-* &>/dev/null)
 (! ls /var/tmp/systemd-private-"$(tr -d '-' < /proc/sys/kernel/random/boot_id)"-test-07-dynamic-user-tmp.service-* &>/dev/null)
 systemctl is-active test-07-dynamic-user-tmp.service
diff --git a/test/units/TEST-07-PID1.exec-timestamps.sh b/test/units/TEST-07-PID1.exec-timestamps.sh
index 0211166ae3..cb602f391c 100755
--- a/test/units/TEST-07-PID1.exec-timestamps.sh
+++ b/test/units/TEST-07-PID1.exec-timestamps.sh
@@ -5,7 +5,7 @@ set -o pipefail
 
 # Check that timestamps of a Type=notify service are consistent
 
-systemd-run --service-type notify --property NotifyAccess=all --unit notify.service --wait sh -c 'systemd-notify --ready; exit 1' || :
+systemd-run --service-type notify --property NotifyAccess=all --unit notify.service --wait bash -c 'systemd-notify --ready; exit 1' || :
 
 start=$(systemctl show --property=ExecMainStartTimestampMonotonic --value notify.service)
 handoff=$(systemctl show --property=ExecMainHandoffTimestampMonotonic --value notify.service)
diff --git a/test/units/TEST-07-PID1.issue-1981.sh b/test/units/TEST-07-PID1.issue-1981.sh
index dcfa9b17b0..33186b7275 100755
--- a/test/units/TEST-07-PID1.issue-1981.sh
+++ b/test/units/TEST-07-PID1.issue-1981.sh
@@ -21,9 +21,9 @@ mkdir -p /run/systemd/system
 cat >/run/systemd/system/my.service <<\EOF
 [Service]
 Type=oneshot
-ExecStartPre=sh -c 'test "$TRIGGER_UNIT" = my.timer'
-ExecStartPre=sh -c 'test -n "$TRIGGER_TIMER_REALTIME_USEC"'
-ExecStartPre=sh -c 'test -n "$TRIGGER_TIMER_MONOTONIC_USEC"'
+ExecStartPre=bash -c 'test "$TRIGGER_UNIT" = my.timer'
+ExecStartPre=bash -c 'test -n "$TRIGGER_TIMER_REALTIME_USEC"'
+ExecStartPre=bash -c 'test -n "$TRIGGER_TIMER_MONOTONIC_USEC"'
 ExecStart=echo Timer runs me
 EOF
 
diff --git a/test/units/TEST-07-PID1.issue-27953.sh b/test/units/TEST-07-PID1.issue-27953.sh
index 8659970a5f..4b2e9507c3 100755
--- a/test/units/TEST-07-PID1.issue-27953.sh
+++ b/test/units/TEST-07-PID1.issue-27953.sh
@@ -7,5 +7,5 @@ set -o pipefail
 # Issue: https://github.com/systemd/systemd/issues/27953
 
 systemctl start issue27953.service
-timeout 10 sh -c 'while systemctl is-active issue27953.service; do sleep .5; done'
+timeout 10 bash -c 'while systemctl is-active issue27953.service; do sleep .5; done'
 [[ "$(systemctl show -P ExitType issue27953.service)" == main ]]
diff --git a/test/units/TEST-07-PID1.issue-30412.sh b/test/units/TEST-07-PID1.issue-30412.sh
index c1cb00e071..afd852ea48 100755
--- a/test/units/TEST-07-PID1.issue-30412.sh
+++ b/test/units/TEST-07-PID1.issue-30412.sh
@@ -28,5 +28,5 @@ systemctl start badbin_assert.socket
 
 socat - ABSTRACT-CONNECT:badbin_assert.socket
 
-timeout 10 sh -c 'while systemctl is-active badbin_assert.service; do sleep .5; done'
+timeout 10 bash -c 'while systemctl is-active badbin_assert.service; do sleep .5; done'
 [[ "$(systemctl show -P ExecMainStatus badbin_assert.service)" == 203 ]]
diff --git a/test/units/TEST-07-PID1.issue-3171.sh b/test/units/TEST-07-PID1.issue-3171.sh
index e1a4b6479f..a4e0b2f1ba 100755
--- a/test/units/TEST-07-PID1.issue-3171.sh
+++ b/test/units/TEST-07-PID1.issue-3171.sh
@@ -24,7 +24,7 @@ cat >/run/systemd/system/issue-3171@.service <<EOF
 Description=Test service
 [Service]
 StandardInput=socket
-ExecStart=sh -x -c cat
+ExecStart=bash -x -c cat
 EOF
 
 systemctl start issue-3171.socket
diff --git a/test/units/TEST-07-PID1.nft.sh b/test/units/TEST-07-PID1.nft.sh
new file mode 100755
index 0000000000..dbfefc281f
--- /dev/null
+++ b/test/units/TEST-07-PID1.nft.sh
@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
+set -eux
+set -o pipefail
+
+if ! command -v nft >/dev/null; then
+    echo "nftables is not installed. Skipped NFTSet= tests."
+    exit 0
+fi
+
+RUN_OUT="$(mktemp)"
+
+run() {
+    "$@" |& tee "$RUN_OUT"
+}
+
+nft add table inet sd_test
+nft add set inet sd_test c '{ type cgroupsv2; }'
+nft add set inet sd_test u '{ typeof meta skuid; }'
+nft add set inet sd_test g '{ typeof meta skgid; }'
+
+# service
+systemd-run --unit test-nft.service --service-type=exec -p DynamicUser=yes \
+            -p 'NFTSet=cgroup:inet:sd_test:c user:inet:sd_test:u group:inet:sd_test:g' sleep 10000
+run nft list set inet sd_test c
+grep -qF "test-nft.service" "$RUN_OUT"
+uid=$(userdbctl user --json=short test-nft | jq .uid)
+run nft list set inet sd_test u
+grep -qF "$uid" "$RUN_OUT"
+gid=$(userdbctl user --json=short test-nft | jq .gid)
+run nft list set inet sd_test g
+grep -qF "$gid" "$RUN_OUT"
+systemctl stop test-nft.service
+
+# scope
+run systemd-run --scope -u test-nft.scope -p 'NFTSet=cgroup:inet:sd_test:c' nft list set inet sd_test c
+grep -qF "test-nft.scope" "$RUN_OUT"
+
+mkdir -p /run/systemd/system
+# socket
+{
+    echo "[Socket]"
+    echo "ListenStream=12345"
+    echo "BindToDevice=lo"
+    echo "NFTSet=cgroup:inet:sd_test:c"
+} >/run/systemd/system/test-nft.socket
+{
+    echo "[Service]"
+    echo "ExecStart=sleep 10000"
+} >/run/systemd/system/test-nft.service
+systemctl daemon-reload
+systemctl start test-nft.socket
+systemctl status test-nft.socket
+run nft list set inet sd_test c
+grep -qF "test-nft.socket" "$RUN_OUT"
+systemctl stop test-nft.socket
+rm -f /run/systemd/system/test-nft.{socket,service}
+
+# slice
+mkdir /run/systemd/system/system.slice.d
+{
+    echo "[Slice]"
+    echo "NFTSet=cgroup:inet:sd_test:c"
+} >/run/systemd/system/system.slice.d/00-test-nft.conf
+systemctl daemon-reload
+run nft list set inet sd_test c
+grep -qF "system.slice" "$RUN_OUT"
+rm -rf /run/systemd/system/system.slice.d
+
+nft flush ruleset
+exit 0
diff --git a/test/units/TEST-07-PID1.private-pids.sh b/test/units/TEST-07-PID1.private-pids.sh
index 091535e3da..ae7e4538b3 100755
--- a/test/units/TEST-07-PID1.private-pids.sh
+++ b/test/units/TEST-07-PID1.private-pids.sh
@@ -50,7 +50,11 @@ testcase_basic() {
     systemd-run -p PrivatePIDs=yes --remain-after-exit --unit TEST-07-PID1-private-pid sleep infinity
     # Wait for ExecMainPID to be correctly populated as there might be a race between spawning service
     # and actual exec child process
-    timeout 10s bash -xec 'until [[ "$(cat /proc/$(systemctl show TEST-07-PID1-private-pid.service -p ExecMainPID --value)/comm)" == sleep ]]; do sleep .5; done'
+    # Note, Alpine/postmarketOS build coreutils with --enable-single-binary=symlinks. In that case, coreutils
+    # calls prctl(PR_SET_NAME, argv[0]), hence the comm will be the path to the symlink. If the sleep file is
+    # a dedicated binary (like most other distributions do), the comm will be the filename, i.e. "sleep". So,
+    # here we need to cut the directory part.
+    timeout 10s bash -xec 'until [[ "$(cat /proc/$(systemctl show TEST-07-PID1-private-pid.service -p ExecMainPID --value)/comm | sed -e "s|.*/||")" == sleep ]]; do sleep .5; done'
     pid=$(systemctl show TEST-07-PID1-private-pid.service -p ExecMainPID --value)
     kill -9 "$pid"
     timeout 10s bash -xec 'while [[ "$(systemctl show -P SubState TEST-07-PID1-private-pid.service)" != "failed" ]]; do sleep .5; done'
diff --git a/test/units/TEST-07-PID1.protect-control-groups.sh b/test/units/TEST-07-PID1.protect-control-groups.sh
index 0220e1b692..d58d6265ec 100755
--- a/test/units/TEST-07-PID1.protect-control-groups.sh
+++ b/test/units/TEST-07-PID1.protect-control-groups.sh
@@ -129,11 +129,11 @@ testcase_delegate_subgroup_control() {
             -p PrivateMounts=yes \
             -p Delegate=yes \
             -p DelegateSubgroup=supervisor \
-            -p ExecStartPost='sh -c "cat /proc/self/cgroup; kill $MAINPID"' \
+            -p ExecStartPost='bash -c "cat /proc/self/cgroup; kill $MAINPID"' \
             --unit delegate-subgroup-control \
             --wait \
             --pipe \
-            sh -c 'echo +pids >/sys/fs/cgroup/cgroup.subtree_control; systemd-notify --ready; sleep infinity'
+            bash -c 'echo +pids >/sys/fs/cgroup/cgroup.subtree_control; systemd-notify --ready; sleep infinity'
     )" "0::/"
 }
 
@@ -150,7 +150,7 @@ testcase_delegate_subgroup_pam() {
         --unit delegate-subgroup-pam \
         --wait \
         --pipe \
-        sh -c 'echo +pids >/sys/fs/cgroup/cgroup.subtree_control'
+        bash -c 'echo +pids >/sys/fs/cgroup/cgroup.subtree_control'
 }
 
 run_testcases
diff --git a/test/units/TEST-07-PID1.transient-unit-container.sh b/test/units/TEST-07-PID1.transient-unit-container.sh
index a17f08bd51..03ffa91a70 100755
--- a/test/units/TEST-07-PID1.transient-unit-container.sh
+++ b/test/units/TEST-07-PID1.transient-unit-container.sh
@@ -121,7 +121,7 @@ After=basic.target
 
 [Service]
 Type=oneshot
-ExecStart=sh -c 'echo "$EXPECTED_OUTPUT"  > "$guest_output"'
+ExecStart=bash -c 'echo "$EXPECTED_OUTPUT"  > "$guest_output"'
 ExecStartPost=systemctl --no-block exit 0
 TimeoutStopSec=15s
 
diff --git a/test/units/TEST-13-NSPAWN.machined.sh b/test/units/TEST-13-NSPAWN.machined.sh
index 7ae23558dc..50a8c142db 100755
--- a/test/units/TEST-13-NSPAWN.machined.sh
+++ b/test/units/TEST-13-NSPAWN.machined.sh
@@ -13,7 +13,7 @@ at_exit() {
     set +e
 
     machinectl status long-running &>/dev/null && machinectl kill --signal=KILL long-running
-    mountpoint -q /var/lib/machines && timeout 30 sh -c "until umount /var/lib/machines; do sleep .5; done"
+    mountpoint -q /var/lib/machines && timeout 30 bash -c "until umount /var/lib/machines; do sleep .5; done"
     [[ -n "${NSPAWN_FRAGMENT:-}" ]] && rm -f "/etc/systemd/nspawn/$NSPAWN_FRAGMENT" "/var/lib/machines/$NSPAWN_FRAGMENT"
     rm -f /run/systemd/nspawn/*.nspawn
 }
diff --git a/test/units/TEST-13-NSPAWN.nspawn-oci.sh b/test/units/TEST-13-NSPAWN.nspawn-oci.sh
index bae3e2e085..1fd2a5ad76 100755
--- a/test/units/TEST-13-NSPAWN.nspawn-oci.sh
+++ b/test/units/TEST-13-NSPAWN.nspawn-oci.sh
@@ -39,6 +39,12 @@ create_dummy_container "$OCI/rootfs"
 mkdir -p "$OCI/rootfs/opt/var"
 mkdir -p "$OCI/rootfs/opt/readonly"
 
+if [[ -e /proc/kcore ]]; then
+    HAVE_PROC_KCORE=1
+else
+    HAVE_PROC_KCORE=0
+fi
+
 # Let's start with a simple config
 cat >"$OCI/config.json" <<EOF
 {
@@ -305,7 +311,7 @@ cat >"$OCI/config.json" <<EOF
     "hooks" : {
         "prestart" : [
             {
-                "path" : "/bin/sh",
+                "path" : "/bin/bash",
                 "args" : [
                     "-xec",
                     "echo \$PRESTART_FOO >/prestart"
@@ -325,7 +331,7 @@ cat >"$OCI/config.json" <<EOF
         ],
         "poststart" : [
             {
-                "path" : "/bin/sh",
+                "path" : "/bin/bash",
                 "args" : [
                     "touch",
                     "/poststart"
@@ -334,7 +340,7 @@ cat >"$OCI/config.json" <<EOF
         ],
         "poststop" : [
             {
-                "path" : "/bin/sh",
+                "path" : "/bin/bash",
                 "args" : [
                     "touch",
                     "/poststop"
@@ -376,8 +382,12 @@ test -b "$DEV"
 [[ "\$(stat -c '%t:%T' "$DEV")" == 4:2 ]]
 
 # Linux - maskedPaths
-test -e /proc/kcore
-cat /proc/kcore && exit 1
+if [[ "$HAVE_PROC_KCORE" == 1 ]]; then
+    test -e /proc/kcore
+    cat /proc/kcore && exit 1
+else
+    test ! -e /proc/kcore
+fi
 test ! -e /root/nonexistent
 
 # Linux - readonlyPaths
@@ -436,7 +446,7 @@ INVALID_SNIPPETS=(
     '"linux" : { "readonlyPaths" : [ "/foo", 1 ] }'
     '"linux" : { "readonlyPaths" : [ "/foo", "bar" ] }'
     # Invalid hooks
-    '"hooks" : { "prestart" : [ { "path" : "/bin/sh", "timeout" : 0 } ] }'
+    '"hooks" : { "prestart" : [ { "path" : "/bin/bash", "timeout" : 0 } ] }'
     # Invalid annotations
     '"annotations" : { "" : "bar" }'
     '"annotations" : { "foo" : 1 }'
@@ -453,7 +463,7 @@ for snippet in "${INVALID_SNIPPETS[@]}"; do
     $snippet
 }
 EOF
-    (! systemd-nspawn --oci-bundle="$OCI" sh -c 'echo hello')
+    (! systemd-nspawn --oci-bundle="$OCI" bash -c 'echo hello')
 done
 
 # Invalid OCI bundle version
@@ -465,4 +475,4 @@ cat >"$OCI/config.json" <<EOF
     }
 }
 EOF
-(! systemd-nspawn --oci-bundle="$OCI" sh -c 'echo hello')
+(! systemd-nspawn --oci-bundle="$OCI" bash -c 'echo hello')
diff --git a/test/units/TEST-13-NSPAWN.nss-mymachines.sh b/test/units/TEST-13-NSPAWN.nss-mymachines.sh
index 5709ec50d7..e4a9616712 100755
--- a/test/units/TEST-13-NSPAWN.nss-mymachines.sh
+++ b/test/units/TEST-13-NSPAWN.nss-mymachines.sh
@@ -7,11 +7,15 @@ set -o pipefail
 # shellcheck source=test/units/util.sh
 . "$(dirname "$0")"/util.sh
 
+if ! check_nss_module mymachine; then
+    exit 0
+fi
+
 at_exit() {
     set +e
 
     machinectl kill --signal=KILL nss-mymachines-{noip,singleip,manyips}
-    mountpoint -q /var/lib/machines && timeout 30 sh -c "until umount /var/lib/machines; do sleep .5; done"
+    mountpoint -q /var/lib/machines && timeout 30 bash -c "until umount /var/lib/machines; do sleep .5; done"
     rm -f /run/systemd/nspawn/*.nspawn
 }
 
diff --git a/test/units/TEST-16-EXTEND-TIMEOUT.sh b/test/units/TEST-16-EXTEND-TIMEOUT.sh
index 93fc0b78f6..9f5c77e4e8 100755
--- a/test/units/TEST-16-EXTEND-TIMEOUT.sh
+++ b/test/units/TEST-16-EXTEND-TIMEOUT.sh
@@ -70,21 +70,21 @@ runtime_max_sec=5
 systemd-run \
     --property=RuntimeMaxSec=${runtime_max_sec}s \
     -u runtime-max-sec-test-1.service \
-    sh -c "while true; do sleep 1; done"
+    bash -c "while true; do sleep 1; done"
 wait_for_timeout runtime-max-sec-test-1.service $((runtime_max_sec + 2))
 
 systemd-run \
     --property=RuntimeMaxSec=${runtime_max_sec}s \
     --scope \
     -u runtime-max-sec-test-2.scope \
-    sh -c "while true; do sleep 1; done" &
+    bash -c "while true; do sleep 1; done" &
 wait_for_timeout runtime-max-sec-test-2.scope $((runtime_max_sec + 2))
 
 # These ensure that RuntimeMaxSec is honored for scope and service
 # units if the value is changed and then the manager is reloaded.
 systemd-run \
     -u runtime-max-sec-test-3.service \
-    sh -c "while true; do sleep 1; done"
+    bash -c "while true; do sleep 1; done"
 mkdir -p /etc/systemd/system/runtime-max-sec-test-3.service.d/
 cat >/etc/systemd/system/runtime-max-sec-test-3.service.d/override.conf <<EOF
 [Service]
@@ -96,7 +96,7 @@ wait_for_timeout runtime-max-sec-test-3.service $((runtime_max_sec + 2))
 systemd-run \
     --scope \
     -u runtime-max-sec-test-4.scope \
-    sh -c "while true; do sleep 1; done" &
+    bash -c "while true; do sleep 1; done" &
 
 # Wait until the unit is running to avoid race with creating the override.
 until systemctl is-active runtime-max-sec-test-4.scope; do
diff --git a/test/units/TEST-17-UDEV.device_is_processing.sh b/test/units/TEST-17-UDEV.device_is_processing.sh
index 7bdb5fc705..34fa126d82 100755
--- a/test/units/TEST-17-UDEV.device_is_processing.sh
+++ b/test/units/TEST-17-UDEV.device_is_processing.sh
@@ -15,9 +15,7 @@ at_exit() {
     systemctl stop testsleep.service
     rm -f /run/udev/udev.conf.d/timeout.conf
     rm -f /run/udev/rules.d/99-testsuite.rules
-    # Forcibly kills sleep command invoked by the udev rule before restarting,
-    # otherwise systemctl restart below will takes longer.
-    killall -KILL sleep
+    killall --regexp '(|/usr/bin/)sleep'
     udevadm control --reload
     ip link del "$IFNAME"
 }
@@ -62,7 +60,7 @@ done
 grep -q -F 'ID_PROCESSING=1' "/run/udev/data/n${IFINDEX}"
 
 # Forcibly kill sleep command invoked by the udev rule to finish processing the add event.
-killall sleep
+killall --regexp '(|/usr/bin/)sleep'
 udevadm settle --timeout=30
 
 # Check if ID_PROCESSING flag is unset, and the device units are active.
diff --git a/test/units/TEST-23-UNIT-FILE.ExecStopPost.sh b/test/units/TEST-23-UNIT-FILE.ExecStopPost.sh
index f20af1a141..228550b76b 100755
--- a/test/units/TEST-23-UNIT-FILE.ExecStopPost.sh
+++ b/test/units/TEST-23-UNIT-FILE.ExecStopPost.sh
@@ -17,7 +17,7 @@ systemd-run --unit=exec1.service --wait -p StandardOutput=tty -p StandardError=t
 test -f /run/exec1
 
 (! systemd-run --unit=exec2.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=exec \
-   -p ExecStopPost='touch /run/exec2' sh -c 'sleep 1; false')
+   -p ExecStopPost='touch /run/exec2' bash -c 'sleep 1; false')
 test -f /run/exec2
 
 cat >/tmp/forking1.sh <<EOF
diff --git a/test/units/TEST-23-UNIT-FILE.StandardOutput.sh b/test/units/TEST-23-UNIT-FILE.StandardOutput.sh
index ec01e990be..409882306e 100755
--- a/test/units/TEST-23-UNIT-FILE.StandardOutput.sh
+++ b/test/units/TEST-23-UNIT-FILE.StandardOutput.sh
@@ -9,7 +9,7 @@ systemd-run --wait --unit=TEST-23-UNIT-FILE-standard-output-one \
             -p StandardOutput=file:/tmp/stdout \
             -p StandardError=file:/tmp/stderr \
             -p Type=exec \
-            sh -c 'echo x ; echo y >&2'
+            bash -c 'echo x ; echo y >&2'
 cmp /tmp/stdout <<EOF
 x
 EOF
@@ -21,7 +21,7 @@ systemd-run --wait --unit=TEST-23-UNIT-FILE-standard-output-two \
             -p StandardOutput=file:/tmp/stdout \
             -p StandardError=file:/tmp/stderr \
             -p Type=exec \
-            sh -c 'echo z ; echo a >&2'
+            bash -c 'echo z ; echo a >&2'
 cmp /tmp/stdout <<EOF
 z
 EOF
@@ -33,7 +33,7 @@ systemd-run --wait --unit=TEST-23-UNIT-FILE-standard-output-three \
             -p StandardOutput=append:/tmp/stdout \
             -p StandardError=append:/tmp/stderr \
             -p Type=exec \
-            sh -c 'echo b ; echo c >&2'
+            bash -c 'echo b ; echo c >&2'
 cmp /tmp/stdout <<EOF
 z
 b
@@ -47,7 +47,7 @@ systemd-run --wait --unit=TEST-23-UNIT-FILE-standard-output-four \
             -p StandardOutput=truncate:/tmp/stdout \
             -p StandardError=truncate:/tmp/stderr \
             -p Type=exec \
-            sh -c 'echo a ; echo b >&2'
+            bash -c 'echo a ; echo b >&2'
 cmp /tmp/stdout <<EOF
 a
 EOF
diff --git a/test/units/TEST-23-UNIT-FILE.statedir.sh b/test/units/TEST-23-UNIT-FILE.statedir.sh
index f2b3adb0d2..64de27f55c 100755
--- a/test/units/TEST-23-UNIT-FILE.statedir.sh
+++ b/test/units/TEST-23-UNIT-FILE.statedir.sh
@@ -56,8 +56,8 @@ test "$(readlink "$HOME"/.local/state/foo)" = ../../.config/foo
 # Check that this will work safely a second time
 systemd-run --user -p StateDirectory=foo -p ConfigurationDirectory=foo --wait true
 
-( ! systemd-run --user -p StateDirectory=foo::ro --wait sh -c "echo foo > $HOME/.local/state/foo/baz")
-( ! systemd-run --user -p StateDirectory=foo:bar:ro --wait sh -c "echo foo > $HOME/.local/state/foo/baz")
+( ! systemd-run --user -p StateDirectory=foo::ro --wait bash -c "echo foo > $HOME/.local/state/foo/baz")
+( ! systemd-run --user -p StateDirectory=foo:bar:ro --wait bash -c "echo foo > $HOME/.local/state/foo/baz")
 ( ! test -f "$HOME"/.local/state/foo/baz)
 test -L "$HOME"/.local/state/bar
 
diff --git a/test/units/TEST-34-DYNAMICUSERMIGRATE.sh b/test/units/TEST-34-DYNAMICUSERMIGRATE.sh
index e89c012dd3..601e44098d 100755
--- a/test/units/TEST-34-DYNAMICUSERMIGRATE.sh
+++ b/test/units/TEST-34-DYNAMICUSERMIGRATE.sh
@@ -23,7 +23,7 @@ test_directory() {
     (! systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"=zzz test -f "${path}"/zzz/test-missing)
     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"="www::ro www:ro:ro" test -d "${path}"/www
     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"="www::ro www:ro:ro" test -L "${path}"/ro
-    (! systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"="www::ro www:ro:ro" sh -c "echo foo > ${path}/www/test-missing")
+    (! systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"="www::ro www:ro:ro" bash -c "echo foo > ${path}/www/test-missing")
 
     test -d "${path}"/zzz
     test ! -L "${path}"/zzz
@@ -50,7 +50,7 @@ test_directory() {
     (! systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=1 -p "${directory}"=zzz test -f "${path}"/zzz/test-missing)
     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=1 -p "${directory}"="www::ro www:ro:ro" test -d "${path}"/www
     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=1 -p "${directory}"="www::ro www:ro:ro" test -L "${path}"/ro
-    (! systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=1 -p "${directory}"="www::ro www:ro:ro" sh -c "echo foo > ${path}/www/test-missing")
+    (! systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=1 -p "${directory}"="www::ro www:ro:ro" bash -c "echo foo > ${path}/www/test-missing")
 
     test -L "${path}"/zzz
     test -d "${path}"/private/zzz
@@ -76,7 +76,7 @@ test_directory() {
     (! systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"=zzz test -f "${path}"/zzz/test-missing)
     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"="www::ro www:ro:ro" test -d "${path}"/www
     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"="www::ro www:ro:ro" test -L "${path}"/ro
-    (! systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"="www::ro www:ro:ro" sh -c "echo foo > ${path}/www/test-missing")
+    (! systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"="www::ro www:ro:ro" bash -c "echo foo > ${path}/www/test-missing")
 
     test -d "${path}"/zzz
     test ! -L "${path}"/zzz
@@ -106,7 +106,7 @@ ExecStart=test -f ${path}/x:yz/test
 ExecStart=test -f ${path}/zzz/test
 ExecStart=test -d ${path}/www
 ExecStart=test -L ${path}/ro
-ExecStart=sh -c "! test -w ${path}/www"
+ExecStart=bash -c "! test -w ${path}/www"
 EOF
     systemctl daemon-reload
     systemctl start --wait testservice-34.service
diff --git a/test/units/TEST-35-LOGIN.sh b/test/units/TEST-35-LOGIN.sh
index e536e0ae5c..c3dd11afa6 100755
--- a/test/units/TEST-35-LOGIN.sh
+++ b/test/units/TEST-35-LOGIN.sh
@@ -25,6 +25,17 @@ setup_test_user() {
     trap cleanup_test_user EXIT
 }
 
+session_bus_path() {
+    local session
+
+    session=$(loginctl list-sessions --no-legend | grep -v manager | awk '$3 == "logind-test-user" { print $1 }')
+    if ! [[ "${session?}" =~ c[0-9]* ]]; then
+        # When numeric, bus path is prefixed with '_3'
+        session="_3${session}"
+    fi
+    echo "/org/freedesktop/login1/session/${session}"
+}
+
 test_write_dropin() {
     systemctl edit --runtime --stdin systemd-logind.service --drop-in=debug.conf <<EOF
 [Service]
@@ -268,6 +279,7 @@ cleanup_session() (
     loginctl terminate-user logind-test-user
 
     if ! timeout 30 bash -c "while loginctl --no-legend | grep -q logind-test-user; do sleep 1; done"; then
+        loginctl
         echo "WARNING: session for logind-test-user still active, ignoring."
     fi
 
@@ -556,12 +568,11 @@ testcase_session_properties() {
     trap cleanup_session RETURN
     create_session
 
-    s=$(loginctl list-sessions --no-legend | grep -v manager | awk '$3 == "logind-test-user" { print $1 }')
-    /usr/lib/systemd/tests/unit-tests/manual/test-session-properties "/org/freedesktop/login1/session/_3${s?}" /dev/tty2
+    /usr/lib/systemd/tests/unit-tests/manual/test-session-properties "$(session_bus_path)" /dev/tty2
 }
 
 testcase_list_users_sessions_seats() {
-    local session seat
+    local path seat
 
     if [[ ! -c /dev/tty2 ]]; then
         echo "/dev/tty2 does not exist, skipping test ${FUNCNAME[0]}."
@@ -574,11 +585,11 @@ testcase_list_users_sessions_seats() {
     # Activate the session
     loginctl activate "$(loginctl --no-legend | grep -v manager | awk '$3 == "logind-test-user" { print $1 }')"
 
-    session=$(loginctl list-sessions --no-legend | grep -v manager | awk '$3 == "logind-test-user" { print $1 }')
+    path=$(session_bus_path)
     : check that we got a valid session id
-    busctl get-property org.freedesktop.login1 "/org/freedesktop/login1/session/_3${session?}" org.freedesktop.login1.Session Id
-    busctl get-property org.freedesktop.login1 "/org/freedesktop/login1/session/_3${session?}" org.freedesktop.login1.Session CanIdle
-    busctl get-property org.freedesktop.login1 "/org/freedesktop/login1/session/_3${session?}" org.freedesktop.login1.Session CanLock
+    busctl get-property org.freedesktop.login1 "$path" org.freedesktop.login1.Session Id
+    busctl get-property org.freedesktop.login1 "$path" org.freedesktop.login1.Session CanIdle
+    busctl get-property org.freedesktop.login1 "$path" org.freedesktop.login1.Session CanLock
     assert_eq "$(loginctl list-sessions --no-legend | grep -v manager | awk '$3 == "logind-test-user" { print $2 }')" "$(id -ru logind-test-user)"
     seat=$(loginctl list-sessions --no-legend | grep -v manager | awk '$3 == "logind-test-user" { print $4 }')
     assert_eq "$(loginctl list-sessions --no-legend | grep -v manager | awk '$3 == "logind-test-user" { print $6 }')" user
diff --git a/test/units/TEST-43-PRIVATEUSER-UNPRIV.sh b/test/units/TEST-43-PRIVATEUSER-UNPRIV.sh
index b28df65fe5..b15d62d4f9 100755
--- a/test/units/TEST-43-PRIVATEUSER-UNPRIV.sh
+++ b/test/units/TEST-43-PRIVATEUSER-UNPRIV.sh
@@ -84,12 +84,12 @@ runas testuser systemd-run --wait --user --unit=test-caps \
 
 runas testuser systemd-run --wait --user --unit=test-devices \
     -p PrivateDevices=yes -p PrivateIPC=yes \
-    sh -c "ls -1 /dev/ | wc -l | grep -q -F 18"
+    bash -c "ls -1 /dev/ | wc -l | grep -q -F 18"
 
 # Same check as test/test-execute/exec-privatenetwork-yes.service
 runas testuser systemd-run --wait --user --unit=test-network \
     -p PrivateNetwork=yes \
-    sh -x -c '! ip link | grep -E "^[0-9]+: " | grep -Ev ": (lo|(erspan|gre|gretap|ip_vti|ip6_vti|ip6gre|ip6tnl|sit|tunl)0@.*):"'
+    bash -x -c '! ip link | grep -E "^[0-9]+: " | grep -Ev ": (lo|(erspan|gre|gretap|ip_vti|ip6_vti|ip6gre|ip6tnl|sit|tunl)0@.*):"'
 
 (! runas testuser systemd-run --wait --user --unit=test-hostname \
     -p ProtectHostname=yes \
@@ -101,11 +101,11 @@ runas testuser systemd-run --wait --user --unit=test-network \
 
 (! runas testuser systemd-run --wait --user --unit=test-kernel-tunable \
     -p ProtectKernelTunables=yes \
-    sh -c "echo 0 >/proc/sys/user/max_user_namespaces")
+    bash -c "echo 0 >/proc/sys/user/max_user_namespaces")
 
 (! runas testuser systemd-run --wait --user --unit=test-kernel-mod \
     -p ProtectKernelModules=yes \
-    sh -c "modprobe -r overlay && modprobe overlay")
+    bash -c "modprobe -r overlay && modprobe overlay")
 
 if sysctl kernel.dmesg_restrict=0; then
     (! runas testuser systemd-run --wait --user --unit=test-kernel-log \
diff --git a/test/units/TEST-46-HOMED.sh b/test/units/TEST-46-HOMED.sh
index 15a53b18f7..d7d29e0893 100755
--- a/test/units/TEST-46-HOMED.sh
+++ b/test/units/TEST-46-HOMED.sh
@@ -1,10 +1,14 @@
 #!/usr/bin/env bash
 # SPDX-License-Identifier: LGPL-2.1-or-later
 # shellcheck disable=SC2016,SC2209
-
 set -eux
 set -o pipefail
 
+# shellcheck source=test/units/test-control.sh
+. "$(dirname "$0")"/test-control.sh
+# shellcheck source=test/units/util.sh
+. "$(dirname "$0")"/util.sh
+
 # Check if homectl is installed, and if it isn't bail out early instead of failing
 if ! command -v homectl >/dev/null; then
     echo "no homed" >/skipped
@@ -47,300 +51,318 @@ mount -t tmpfs tmpfs /home -o size=290M
 # Make sure systemd-homed takes notice of the overmounted /home/
 systemctl kill -sUSR1 systemd-homed
 
-TMP_SKEL=$(mktemp -d)
-echo hogehoge >"$TMP_SKEL"/hoge
+testcase_basic() {
+    local TMP_SKEL
 
-# we enable --luks-discard= since we run our tests in a tight VM, hence don't
-# needlessly pressure for storage. We also set the cheapest KDF, since we don't
-# want to waste CI CPU cycles on it. We also effectively disable rate-limiting on
-# the user by allowing 1000 logins per second
-NEWPASSWORD=xEhErW0ndafV4s homectl create test-user \
-           --disk-size=min \
-           --luks-discard=yes \
-           --image-path=/home/test-user.home \
-           --luks-pbkdf-type=pbkdf2 \
-           --luks-pbkdf-time-cost=1ms \
-           --rate-limit-interval=1s \
-           --rate-limit-burst=1000 \
-           --skel="$TMP_SKEL"
-inspect test-user
+    . /etc/os-release
+    if [[ "${ID_LIKE:-}" == alpine ]] && ! systemd-detect-virt -cq; then
+        # luks seems to be broken on alpine/postmarketos.
+        return 0
+    fi
 
-PASSWORD=xEhErW0ndafV4s homectl authenticate test-user
+    TMP_SKEL=$(mktemp -d)
+    echo hogehoge >"$TMP_SKEL"/hoge
 
-PASSWORD=xEhErW0ndafV4s homectl activate test-user
-inspect test-user
+    # we enable --luks-discard= since we run our tests in a tight VM, hence don't
+    # needlessly pressure for storage. We also set the cheapest KDF, since we don't
+    # want to waste CI CPU cycles on it. We also effectively disable rate-limiting on
+    # the user by allowing 1000 logins per second
+    NEWPASSWORD=xEhErW0ndafV4s \
+        homectl create test-user \
+        --disk-size=min \
+        --luks-discard=yes \
+        --image-path=/home/test-user.home \
+        --luks-pbkdf-type=pbkdf2 \
+        --luks-pbkdf-time-cost=1ms \
+        --rate-limit-interval=1s \
+        --rate-limit-burst=1000 \
+        --skel="$TMP_SKEL"
+    inspect test-user
 
-PASSWORD=xEhErW0ndafV4s homectl update test-user --real-name="Inline test"
-inspect test-user
+    PASSWORD=xEhErW0ndafV4s homectl authenticate test-user
 
-homectl deactivate test-user
-inspect test-user
-
-PASSWORD=xEhErW0ndafV4s NEWPASSWORD=yPN4N0fYNKUkOq homectl passwd test-user
-inspect test-user
-
-PASSWORD=yPN4N0fYNKUkOq homectl activate test-user
-inspect test-user
-
-SYSTEMD_LOG_LEVEL=debug PASSWORD=yPN4N0fYNKUkOq NEWPASSWORD=xEhErW0ndafV4s homectl passwd test-user
-inspect test-user
-
-homectl deactivate test-user
-inspect test-user
-
-homectl update test-user --real-name "Offline test" --offline
-inspect test-user
-
-PASSWORD=xEhErW0ndafV4s homectl activate test-user
-inspect test-user
-
-# Ensure that the offline changes were propagated in
-grep "Offline test" /home/test-user/.identity
-
-homectl deactivate test-user
-inspect test-user
-
-PASSWORD=xEhErW0ndafV4s homectl update test-user --real-name="Inactive test"
-inspect test-user
-
-PASSWORD=xEhErW0ndafV4s homectl activate test-user
-inspect test-user
-
-homectl deactivate test-user
-inspect test-user
-
-# Do some keyring tests, but only on real kernels, since keyring access inside of containers will fail
-# (See: https://github.com/systemd/systemd/issues/17606)
-if ! systemd-detect-virt -cq ; then
     PASSWORD=xEhErW0ndafV4s homectl activate test-user
     inspect test-user
 
-    # Key should now be in the keyring
-    homectl update test-user --real-name "Keyring Test"
-    inspect test-user
-
-    # These commands shouldn't use the keyring
-    (! timeout 5s homectl authenticate test-user )
-    (! NEWPASSWORD="foobar" timeout 5s homectl passwd test-user )
-
-    homectl lock test-user
-    inspect test-user
-
-    # Key should be gone from keyring
-    (! timeout 5s homectl update test-user --real-name "Keyring Test 2" )
-
-    PASSWORD=xEhErW0ndafV4s homectl unlock test-user
-    inspect test-user
-
-    # Key should have been re-instantiated into the keyring
-    homectl update test-user --real-name "Keyring Test 3"
+    PASSWORD=xEhErW0ndafV4s homectl update test-user --real-name="Inline test"
     inspect test-user
 
     homectl deactivate test-user
     inspect test-user
-fi
 
-# Do some resize tests, but only if we run on real kernels and are on btrfs, as quota inside of containers
-# will fail and minimizing while active only works on btrfs.
-if ! systemd-detect-virt -cq && [[ "$FSTYPE" == "btrfs" ]]; then
-    # grow while inactive
-    PASSWORD=xEhErW0ndafV4s homectl resize test-user 300M
+    PASSWORD=xEhErW0ndafV4s NEWPASSWORD=yPN4N0fYNKUkOq homectl passwd test-user
     inspect test-user
 
-    # minimize while inactive
-    PASSWORD=xEhErW0ndafV4s homectl resize test-user min
+    PASSWORD=yPN4N0fYNKUkOq homectl activate test-user
+    inspect test-user
+
+    SYSTEMD_LOG_LEVEL=debug PASSWORD=yPN4N0fYNKUkOq NEWPASSWORD=xEhErW0ndafV4s homectl passwd test-user
+    inspect test-user
+
+    homectl deactivate test-user
+    inspect test-user
+
+    homectl update test-user --real-name "Offline test" --offline
     inspect test-user
 
     PASSWORD=xEhErW0ndafV4s homectl activate test-user
     inspect test-user
 
-    # grow while active
-    PASSWORD=xEhErW0ndafV4s homectl resize test-user max
+    # Ensure that the offline changes were propagated in
+    grep "Offline test" /home/test-user/.identity
+
+    homectl deactivate test-user
     inspect test-user
 
-    # minimize while active
-    PASSWORD=xEhErW0ndafV4s homectl resize test-user 0
+    PASSWORD=xEhErW0ndafV4s homectl update test-user --real-name="Inactive test"
     inspect test-user
 
-    # grow while active
-    PASSWORD=xEhErW0ndafV4s homectl resize test-user 300M
+    PASSWORD=xEhErW0ndafV4s homectl activate test-user
     inspect test-user
 
-    # shrink to original size while active
-    PASSWORD=xEhErW0ndafV4s homectl resize test-user 256M
+    homectl deactivate test-user
     inspect test-user
 
-    # minimize again
-    PASSWORD=xEhErW0ndafV4s homectl resize test-user min
-    inspect test-user
+    # Do some keyring tests, but only on real kernels, since keyring access inside of containers will fail
+    # (See: https://github.com/systemd/systemd/issues/17606)
+    if ! systemd-detect-virt -cq ; then
+        PASSWORD=xEhErW0ndafV4s homectl activate test-user
+        inspect test-user
 
-    # Increase space, so that we can reasonably rebalance free space between to home dirs
-    mount /home -o remount,size=800M
+        # Key should now be in the keyring
+        homectl update test-user --real-name "Keyring Test"
+        inspect test-user
 
-    # create second user
-    NEWPASSWORD=uuXoo8ei homectl create test-user2 \
-           --disk-size=min \
-           --luks-discard=yes \
-           --image-path=/home/test-user2.home \
-           --luks-pbkdf-type=pbkdf2 \
-           --luks-pbkdf-time-cost=1ms \
-           --rate-limit-interval=1s \
-           --rate-limit-burst=1000
-    inspect test-user2
+        # These commands shouldn't use the keyring
+        (! timeout 5s homectl authenticate test-user )
+        (! NEWPASSWORD="foobar" timeout 5s homectl passwd test-user )
 
-    # activate second user
-    PASSWORD=uuXoo8ei homectl activate test-user2
-    inspect test-user2
+        homectl lock test-user
+        inspect test-user
 
-    # set second user's rebalance weight to 100
-    PASSWORD=uuXoo8ei homectl update test-user2 --rebalance-weight=100
-    inspect test-user2
+        # Key should be gone from keyring
+        (! timeout 5s homectl update test-user --real-name "Keyring Test 2" )
 
-    # set first user's rebalance weight to quarter of that of the second
-    PASSWORD=xEhErW0ndafV4s homectl update test-user --rebalance-weight=25
-    inspect test-user
+        PASSWORD=xEhErW0ndafV4s homectl unlock test-user
+        inspect test-user
 
-    # synchronously rebalance
-    homectl rebalance
-    inspect test-user
-    inspect test-user2
+        # Key should have been re-instantiated into the keyring
+        homectl update test-user --real-name "Keyring Test 3"
+        inspect test-user
 
-    wait_for_state test-user2 active
-    homectl deactivate test-user2
-    wait_for_state test-user2 inactive
-    homectl remove test-user2
-fi
+        homectl deactivate test-user
+        inspect test-user
+    fi
 
-PASSWORD=xEhErW0ndafV4s homectl with test-user -- test ! -f /home/test-user/xyz
-(! PASSWORD=xEhErW0ndafV4s homectl with test-user -- test -f /home/test-user/xyz)
-PASSWORD=xEhErW0ndafV4s homectl with test-user -- touch /home/test-user/xyz
-PASSWORD=xEhErW0ndafV4s homectl with test-user -- test -f /home/test-user/xyz
-PASSWORD=xEhErW0ndafV4s homectl with test-user -- rm /home/test-user/xyz
-PASSWORD=xEhErW0ndafV4s homectl with test-user -- test ! -f /home/test-user/xyz
-(! PASSWORD=xEhErW0ndafV4s homectl with test-user -- test -f /home/test-user/xyz)
-[[ $(PASSWORD=xEhErW0ndafV4s homectl with test-user -- stat -c %U /home/test-user/hoge) == "test-user" ]]
-[[ $(PASSWORD=xEhErW0ndafV4s homectl with test-user -- cat /home/test-user/hoge) == "$(cat "$TMP_SKEL"/hoge)" ]]
+    # Do some resize tests, but only if we run on real kernels and are on btrfs, as quota inside of containers
+    # will fail and minimizing while active only works on btrfs.
+    if ! systemd-detect-virt -cq && [[ "$FSTYPE" == "btrfs" ]]; then
+        # grow while inactive
+        PASSWORD=xEhErW0ndafV4s homectl resize test-user 300M
+        inspect test-user
 
-# Regression tests
-wait_for_state test-user inactive
-/usr/lib/systemd/tests/unit-tests/manual/test-homed-regression-31896 test-user
+        # minimize while inactive
+        PASSWORD=xEhErW0ndafV4s homectl resize test-user min
+        inspect test-user
 
-wait_for_state test-user inactive
-homectl remove test-user
+        PASSWORD=xEhErW0ndafV4s homectl activate test-user
+        inspect test-user
 
-# blob directory tests
-# See docs/USER_RECORD_BLOB_DIRS.md
-checkblob() {
-    test -f "/var/cache/systemd/home/blob-user/$1"
-    stat -c "%u %#a" "/var/cache/systemd/home/blob-user/$1" | grep "^0 0644"
-    test -f "/home/blob-user/.identity-blob/$1"
-    stat -c "%u %#a" "/home/blob-user/.identity-blob/$1" | grep "^12345 0644"
+        # grow while active
+        PASSWORD=xEhErW0ndafV4s homectl resize test-user max
+        inspect test-user
 
-    diff "/var/cache/systemd/home/blob-user/$1" "$2"
-    diff "/var/cache/systemd/home/blob-user/$1" "/home/blob-user/.identity-blob/$1"
+        # minimize while active
+        PASSWORD=xEhErW0ndafV4s homectl resize test-user 0
+        inspect test-user
+
+        # grow while active
+        PASSWORD=xEhErW0ndafV4s homectl resize test-user 300M
+        inspect test-user
+
+        # shrink to original size while active
+        PASSWORD=xEhErW0ndafV4s homectl resize test-user 256M
+        inspect test-user
+
+        # minimize again
+        PASSWORD=xEhErW0ndafV4s homectl resize test-user min
+        inspect test-user
+
+        # Increase space, so that we can reasonably rebalance free space between to home dirs
+        mount /home -o remount,size=800M
+
+        # create second user
+        NEWPASSWORD=uuXoo8ei \
+            homectl create test-user2 \
+            --disk-size=min \
+            --luks-discard=yes \
+            --image-path=/home/test-user2.home \
+            --luks-pbkdf-type=pbkdf2 \
+            --luks-pbkdf-time-cost=1ms \
+            --rate-limit-interval=1s \
+            --rate-limit-burst=1000
+        inspect test-user2
+
+        # activate second user
+        PASSWORD=uuXoo8ei homectl activate test-user2
+        inspect test-user2
+
+        # set second user's rebalance weight to 100
+        PASSWORD=uuXoo8ei homectl update test-user2 --rebalance-weight=100
+        inspect test-user2
+
+        # set first user's rebalance weight to quarter of that of the second
+        PASSWORD=xEhErW0ndafV4s homectl update test-user --rebalance-weight=25
+        inspect test-user
+
+        # synchronously rebalance
+        homectl rebalance
+        inspect test-user
+        inspect test-user2
+
+        wait_for_state test-user2 active
+        homectl deactivate test-user2
+        wait_for_state test-user2 inactive
+        homectl remove test-user2
+    fi
+
+    PASSWORD=xEhErW0ndafV4s homectl with test-user -- test ! -f /home/test-user/xyz
+    (! PASSWORD=xEhErW0ndafV4s homectl with test-user -- test -f /home/test-user/xyz)
+    PASSWORD=xEhErW0ndafV4s homectl with test-user -- touch /home/test-user/xyz
+    PASSWORD=xEhErW0ndafV4s homectl with test-user -- test -f /home/test-user/xyz
+    PASSWORD=xEhErW0ndafV4s homectl with test-user -- rm /home/test-user/xyz
+    PASSWORD=xEhErW0ndafV4s homectl with test-user -- test ! -f /home/test-user/xyz
+    (! PASSWORD=xEhErW0ndafV4s homectl with test-user -- test -f /home/test-user/xyz)
+    if check_nss_module systemd; then
+        [[ "$(PASSWORD=xEhErW0ndafV4s homectl with test-user -- stat -c %U /home/test-user/hoge)" == "test-user" ]]
+        [[ "$(PASSWORD=xEhErW0ndafV4s homectl with test-user -- stat -c %u /home/test-user/hoge)" == "$(id -u test-user)" ]]
+    fi
+    # The machine ID may start with a numeric, and in that case the field name must be quoted.
+    [[ "$(PASSWORD=xEhErW0ndafV4s homectl with test-user -- stat -c %u /home/test-user/hoge)" == \
+       "$(homectl inspect --json=short test-user | jq .binding.\""$(cat /etc/machine-id)"\".uid)" ]]
+    [[ "$(PASSWORD=xEhErW0ndafV4s homectl with test-user -- cat /home/test-user/hoge)" == "$(cat "$TMP_SKEL"/hoge)" ]]
+
+    # Regression tests
+    wait_for_state test-user inactive
+    /usr/lib/systemd/tests/unit-tests/manual/test-homed-regression-31896 test-user
+
+    wait_for_state test-user inactive
+    homectl remove test-user
 }
 
-mkdir /tmp/blob1 /tmp/blob2
-echo data1 blob1 >/tmp/blob1/test1
-echo data1 blob2 >/tmp/blob2/test1
-echo data2 blob1 >/tmp/blob1/test2
-echo data2 blob2 >/tmp/blob2/test2
-echo invalid filename >/tmp/blob1/файл
-echo data3 >/tmp/external-test3
-echo avatardata >/tmp/external-avatar
-ln -s /tmp/external-avatar /tmp/external-avatar-lnk
-dd if=/dev/urandom of=/tmp/external-barely-fits bs=1M count=64
-dd if=/dev/urandom of=/tmp/external-toobig bs=1M count=65
+testcase_blob() {
+    . /etc/os-release
+    if [[ "${ID_LIKE:-}" == alpine ]] && ! systemd-detect-virt -cq; then
+        # luks seems to be broken on alpine/postmarketos.
+        return 0
+    fi
 
-# create w/ prepopulated blob dir
-NEWPASSWORD=EMJuc3zQaMibJo homectl create blob-user \
-           --disk-size=min --luks-discard=yes \
-           --luks-pbkdf-type=pbkdf2 --luks-pbkdf-time-cost=1ms \
-           --rate-limit-interval=1s --rate-limit-burst=1000 \
-           --uid=12345 \
-           --blob=/tmp/blob1
-inspect blob-user
-PASSWORD=EMJuc3zQaMibJo homectl activate blob-user
-inspect blob-user
+    # blob directory tests
+    # See docs/USER_RECORD_BLOB_DIRS.md
+    checkblob() {
+        test -f "/var/cache/systemd/home/blob-user/$1"
+        stat -c "%u %#a" "/var/cache/systemd/home/blob-user/$1" | grep "^0 0644"
+        test -f "/home/blob-user/.identity-blob/$1"
+        stat -c "%u %#a" "/home/blob-user/.identity-blob/$1" | grep "^12345 0644"
 
-test -d /var/cache/systemd/home/blob-user
-stat -c "%u %#a" /var/cache/systemd/home/blob-user | grep "^0 0755"
-test -d /home/blob-user/.identity-blob
-stat -c "%u %#a" /home/blob-user/.identity-blob | grep "^12345 0700"
+        diff "/var/cache/systemd/home/blob-user/$1" "$2"
+        diff "/var/cache/systemd/home/blob-user/$1" "/home/blob-user/.identity-blob/$1"
+    }
 
-checkblob test1 /tmp/blob1/test1
-(! checkblob test1 /tmp/blob2/test1 )
-checkblob test2 /tmp/blob1/test2
-(! checkblob test2 /tmp/blob2/test2 )
-(! checkblob фаил /tmp/blob1/фаил )
-(! checkblob test3 /tmp/external-test3 )
-(! checkblob avatar /tmp/external-avatar )
+    mkdir /tmp/blob1 /tmp/blob2
+    echo data1 blob1 >/tmp/blob1/test1
+    echo data1 blob2 >/tmp/blob2/test1
+    echo data2 blob1 >/tmp/blob1/test2
+    echo data2 blob2 >/tmp/blob2/test2
+    echo invalid filename >/tmp/blob1/файл
+    echo data3 >/tmp/external-test3
+    echo avatardata >/tmp/external-avatar
+    ln -s /tmp/external-avatar /tmp/external-avatar-lnk
+    dd if=/dev/urandom of=/tmp/external-barely-fits bs=1M count=64
+    dd if=/dev/urandom of=/tmp/external-toobig bs=1M count=65
 
-# append files to existing blob, both well-known and other
-PASSWORD=EMJuc3zQaMibJo homectl update blob-user \
+    # create w/ prepopulated blob dir
+    NEWPASSWORD=EMJuc3zQaMibJo \
+        homectl create blob-user \
+        --disk-size=min --luks-discard=yes \
+        --luks-pbkdf-type=pbkdf2 --luks-pbkdf-time-cost=1ms \
+        --rate-limit-interval=1s --rate-limit-burst=1000 \
+        --uid=12345 \
+        --blob=/tmp/blob1
+    inspect blob-user
+    PASSWORD=EMJuc3zQaMibJo homectl activate blob-user
+    inspect blob-user
+
+    test -d /var/cache/systemd/home/blob-user
+    stat -c "%u %#a" /var/cache/systemd/home/blob-user | grep "^0 0755"
+    test -d /home/blob-user/.identity-blob
+    stat -c "%u %#a" /home/blob-user/.identity-blob | grep "^12345 0700"
+
+    checkblob test1 /tmp/blob1/test1
+    (! checkblob test1 /tmp/blob2/test1 )
+    checkblob test2 /tmp/blob1/test2
+    (! checkblob test2 /tmp/blob2/test2 )
+    (! checkblob фаил /tmp/blob1/фаил )
+    (! checkblob test3 /tmp/external-test3 )
+    (! checkblob avatar /tmp/external-avatar )
+
+    # append files to existing blob, both well-known and other
+    PASSWORD=EMJuc3zQaMibJo \
+        homectl update blob-user \
         -b test3=/tmp/external-test3 --avatar=/tmp/external-avatar
-inspect blob-user
-checkblob test1 /tmp/blob1/test1
-(! checkblob test1 /tmp/blob2/test1 )
-checkblob test2 /tmp/blob1/test2
-(! checkblob test2 /tmp/blob2/test2 )
-(! checkblob фаил /tmp/blob1/фаил )
-checkblob test3 /tmp/external-test3
-checkblob avatar /tmp/external-avatar
+    inspect blob-user
+    checkblob test1 /tmp/blob1/test1
+    (! checkblob test1 /tmp/blob2/test1 )
+    checkblob test2 /tmp/blob1/test2
+    (! checkblob test2 /tmp/blob2/test2 )
+    (! checkblob фаил /tmp/blob1/фаил )
+    checkblob test3 /tmp/external-test3
+    checkblob avatar /tmp/external-avatar
 
-# delete files from existing blob, both well-known and other
-PASSWORD=EMJuc3zQaMibJo homectl update blob-user \
+    # delete files from existing blob, both well-known and other
+    PASSWORD=EMJuc3zQaMibJo \
+        homectl update blob-user \
         -b test3= --avatar=
-inspect blob-user
-checkblob test1 /tmp/blob1/test1
-(! checkblob test1 /tmp/blob2/test1 )
-checkblob test2 /tmp/blob1/test2
-(! checkblob test2 /tmp/blob2/test2 )
-(! checkblob фаил /tmp/blob1/фаил )
-(! checkblob test3 /tmp/external-test3 )
-(! checkblob avatar /tmp/external-avatar )
+    inspect blob-user
+    checkblob test1 /tmp/blob1/test1
+    (! checkblob test1 /tmp/blob2/test1 )
+    checkblob test2 /tmp/blob1/test2
+    (! checkblob test2 /tmp/blob2/test2 )
+    (! checkblob фаил /tmp/blob1/фаил )
+    (! checkblob test3 /tmp/external-test3 )
+    (! checkblob avatar /tmp/external-avatar )
 
-# swap entire blob directory
-PASSWORD=EMJuc3zQaMibJo homectl update blob-user \
+    # swap entire blob directory
+    PASSWORD=EMJuc3zQaMibJo \
+        homectl update blob-user \
         -b /tmp/blob2
-inspect blob-user
-(! checkblob test1 /tmp/blob1/test1 )
-checkblob test1 /tmp/blob2/test1
-(! checkblob test2 /tmp/blob1/test2 )
-checkblob test2 /tmp/blob2/test2
-(! checkblob фаил /tmp/blob1/фаил )
-(! checkblob test3 /tmp/external-test3 )
-(! checkblob avatar /tmp/external-avatar )
+    inspect blob-user
+    (! checkblob test1 /tmp/blob1/test1 )
+    checkblob test1 /tmp/blob2/test1
+    (! checkblob test2 /tmp/blob1/test2 )
+    checkblob test2 /tmp/blob2/test2
+    (! checkblob фаил /tmp/blob1/фаил )
+    (! checkblob test3 /tmp/external-test3 )
+    (! checkblob avatar /tmp/external-avatar )
 
-# create and delete files while swapping blob directory. Also symlinks.
-PASSWORD=EMJuc3zQaMibJo homectl update blob-user \
+    # create and delete files while swapping blob directory. Also symlinks.
+    PASSWORD=EMJuc3zQaMibJo \
+        homectl update blob-user \
         -b /tmp/blob1 -b test2= -b test3=/tmp/external-test3 --avatar=/tmp/external-avatar-lnk
-inspect blob-user
-checkblob test1 /tmp/blob1/test1
-(! checkblob test1 /tmp/blob2/test1 )
-(! checkblob test2 /tmp/blob1/test2 )
-(! checkblob test2 /tmp/blob2/test2 )
-(! checkblob фаил /tmp/blob1/фаил )
-checkblob test3 /tmp/external-test3
-checkblob avatar /tmp/external-avatar # target of the link
+    inspect blob-user
+    checkblob test1 /tmp/blob1/test1
+    (! checkblob test1 /tmp/blob2/test1 )
+    (! checkblob test2 /tmp/blob1/test2 )
+    (! checkblob test2 /tmp/blob2/test2 )
+    (! checkblob фаил /tmp/blob1/фаил )
+    checkblob test3 /tmp/external-test3
+    checkblob avatar /tmp/external-avatar # target of the link
 
-# clear the blob directory
-PASSWORD=EMJuc3zQaMibJo homectl update blob-user \
+    # clear the blob directory
+    PASSWORD=EMJuc3zQaMibJo \
+        homectl update blob-user \
         -b /tmp/blob2 -b test3=/tmp/external-test3 --blob=
-inspect blob-user
-(! checkblob test1 /tmp/blob1/test1 )
-(! checkblob test1 /tmp/blob2/test1 )
-(! checkblob test2 /tmp/blob1/test2 )
-(! checkblob test2 /tmp/blob2/test2 )
-(! checkblob фаил /tmp/blob1/фаил )
-(! checkblob test3 /tmp/external-test3 )
-(! checkblob avatar /tmp/external-avatar )
-
-# file that's exactly 64M still fits
-# FIXME: Figure out why this fails on ext4.
-if [[ "$FSTYPE" != "ext2/ext3" ]]; then
-    PASSWORD=EMJuc3zQaMibJo homectl update blob-user \
-            -b barely-fits=/tmp/external-barely-fits
+    inspect blob-user
     (! checkblob test1 /tmp/blob1/test1 )
     (! checkblob test1 /tmp/blob2/test1 )
     (! checkblob test2 /tmp/blob1/test2 )
@@ -348,46 +370,62 @@ if [[ "$FSTYPE" != "ext2/ext3" ]]; then
     (! checkblob фаил /tmp/blob1/фаил )
     (! checkblob test3 /tmp/external-test3 )
     (! checkblob avatar /tmp/external-avatar )
-    checkblob barely-fits /tmp/external-barely-fits
-fi
 
-# error out if the file is too big
-(! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b huge=/tmp/external-toobig )
+    # file that's exactly 64M still fits
+    # FIXME: Figure out why this fails on ext4.
+    if [[ "$FSTYPE" != "ext2/ext3" ]]; then
+        PASSWORD=EMJuc3zQaMibJo \
+            homectl update blob-user \
+            -b barely-fits=/tmp/external-barely-fits
+        (! checkblob test1 /tmp/blob1/test1 )
+        (! checkblob test1 /tmp/blob2/test1 )
+        (! checkblob test2 /tmp/blob1/test2 )
+        (! checkblob test2 /tmp/blob2/test2 )
+        (! checkblob фаил /tmp/blob1/фаил )
+        (! checkblob test3 /tmp/external-test3 )
+        (! checkblob avatar /tmp/external-avatar )
+        checkblob barely-fits /tmp/external-barely-fits
+    fi
 
-# error out if filenames are invalid
-(! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b .hidden=/tmp/external-test3 )
-(! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b "with spaces=/tmp/external-test3" )
-(! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b with=equals=/tmp/external-test3 )
-(! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b файл=/tmp/external-test3 )
-(! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b special@chars=/tmp/external-test3 )
+    # error out if the file is too big
+    (! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b huge=/tmp/external-toobig )
 
-# Make sure offline updates to blobs get propagated in
-homectl deactivate blob-user
-inspect blob-user
-homectl update blob-user --offline -b barely-fits= -b propagated=/tmp/external-test3
-inspect blob-user
-PASSWORD=EMJuc3zQaMibJo homectl activate blob-user
-inspect blob-user
-(! checkblob barely-fits /tmp/external-barely-fits )
-checkblob propagated /tmp/external-test3
+    # error out if filenames are invalid
+    (! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b .hidden=/tmp/external-test3 )
+    (! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b "with spaces=/tmp/external-test3" )
+    (! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b with=equals=/tmp/external-test3 )
+    (! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b файл=/tmp/external-test3 )
+    (! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b special@chars=/tmp/external-test3 )
 
-homectl deactivate blob-user
-wait_for_state blob-user inactive
-homectl remove blob-user
+    # Make sure offline updates to blobs get propagated in
+    homectl deactivate blob-user
+    inspect blob-user
+    homectl update blob-user --offline -b barely-fits= -b propagated=/tmp/external-test3
+    inspect blob-user
+    PASSWORD=EMJuc3zQaMibJo homectl activate blob-user
+    inspect blob-user
+    (! checkblob barely-fits /tmp/external-barely-fits )
+    checkblob propagated /tmp/external-test3
 
-# userdbctl tests
-export PAGER=
+    homectl deactivate blob-user
+    wait_for_state blob-user inactive
+    homectl remove blob-user
+}
 
-# Create a couple of user/group records to test io.systemd.DropIn
-# See docs/USER_RECORD.md and docs/GROUP_RECORD.md
-mkdir -p /run/userdb/
-cat >"/run/userdb/dropingroup.group" <<\EOF
+testcase_userdbctl() {
+    # userdbctl tests
+    export PAGER=
+
+    # Create a couple of user/group records to test io.systemd.DropIn
+    # See docs/USER_RECORD.md and docs/GROUP_RECORD.md
+    mkdir -p /run/userdb/
+    cat >"/run/userdb/dropingroup.group" <<\EOF
 {
     "groupName" : "dropingroup",
     "gid"       : 1000000
 }
 EOF
-cat >"/run/userdb/dropinuser.user" <<\EOF
+    cat >"/run/userdb/dropinuser.user" <<\EOF
 {
     "userName" : "dropinuser",
     "uid"      : 2000000,
@@ -397,7 +435,7 @@ cat >"/run/userdb/dropinuser.user" <<\EOF
     ]
 }
 EOF
-cat >"/run/userdb/dropinuser.user-privileged" <<\EOF
+    cat >"/run/userdb/dropinuser.user-privileged" <<\EOF
 {
     "privileged" : {
         "hashedPassword" : [
@@ -410,161 +448,177 @@ cat >"/run/userdb/dropinuser.user-privileged" <<\EOF
     }
 }
 EOF
-# Set permissions and create necessary symlinks as described in nss-systemd(8)
-chmod 0600 "/run/userdb/dropinuser.user-privileged"
-ln -svrf "/run/userdb/dropingroup.group" "/run/userdb/1000000.group"
-ln -svrf "/run/userdb/dropinuser.user" "/run/userdb/2000000.user"
-ln -svrf "/run/userdb/dropinuser.user-privileged" "/run/userdb/2000000.user-privileged"
+    # Set permissions and create necessary symlinks as described in nss-systemd(8)
+    chmod 0600 "/run/userdb/dropinuser.user-privileged"
+    ln -svrf "/run/userdb/dropingroup.group" "/run/userdb/1000000.group"
+    ln -svrf "/run/userdb/dropinuser.user" "/run/userdb/2000000.user"
+    ln -svrf "/run/userdb/dropinuser.user-privileged" "/run/userdb/2000000.user-privileged"
 
-userdbctl
-userdbctl --version
-userdbctl --help --no-pager
-userdbctl --no-legend
-userdbctl --output=classic
-userdbctl --output=friendly
-userdbctl --output=table
-userdbctl --output=json | jq
-userdbctl -j --json=pretty | jq
-userdbctl -j --json=short | jq
-userdbctl --with-varlink=no
+    userdbctl
+    userdbctl --version
+    userdbctl --help --no-pager
+    userdbctl --no-legend
+    userdbctl --output=classic
+    userdbctl --output=friendly
+    userdbctl --output=table
+    userdbctl --output=json | jq
+    userdbctl -j --json=pretty | jq
+    userdbctl -j --json=short | jq
+    userdbctl --with-varlink=no
 
-userdbctl user
-userdbctl user -S
-userdbctl user -IS
-userdbctl user -R
-userdbctl user --disposition=regular --disposition=intrinsic
-userdbctl user kkkk -z
-userdbctl user --uid-min=100 --uid-max=100
-userdbctl user -B
-userdbctl user testuser
-userdbctl user root
-userdbctl user testuser root
-userdbctl user -j testuser root | jq
-# Check only UID for the nobody user, since the name is build-configurable
-userdbctl user --with-nss=no --synthesize=yes
-userdbctl user --with-nss=no --synthesize=yes 0 root 65534
-userdbctl user dropinuser
-userdbctl user 2000000
-userdbctl user --with-nss=no --with-varlink=no --synthesize=no --multiplexer=no dropinuser
-userdbctl user --with-nss=no 2000000
-(! userdbctl user '')
-(! userdbctl user 🐱)
-(! userdbctl user 🐱 '' bar)
-(! userdbctl user i-do-not-exist)
-(! userdbctl user root i-do-not-exist testuser)
-(! userdbctl user --with-nss=no --synthesize=no 0 root 65534)
-(! userdbctl user -N root nobody)
-(! userdbctl user --with-dropin=no dropinuser)
-(! userdbctl user --with-dropin=no 2000000)
+    userdbctl user
+    userdbctl user -S
+    userdbctl user -IS
+    userdbctl user -R
+    userdbctl user --disposition=regular --disposition=intrinsic
+    userdbctl user kkkk -z
+    userdbctl user --uid-min=100 --uid-max=100
+    userdbctl user -B
+    userdbctl user testuser
+    userdbctl user root
+    userdbctl user testuser root
+    userdbctl user -j testuser root | jq
+    # Check only UID for the nobody user, since the name is build-configurable
+    userdbctl user --with-nss=no --synthesize=yes
+    userdbctl user --with-nss=no --synthesize=yes 0 root 65534
+    userdbctl user dropinuser
+    userdbctl user 2000000
+    userdbctl user --with-nss=no --with-varlink=no --synthesize=no --multiplexer=no dropinuser
+    userdbctl user --with-nss=no 2000000
+    (! userdbctl user '')
+    (! userdbctl user 🐱)
+    (! userdbctl user 🐱 '' bar)
+    (! userdbctl user i-do-not-exist)
+    (! userdbctl user root i-do-not-exist testuser)
+    (! userdbctl user --with-nss=no --synthesize=no 0 root 65534)
+    (! userdbctl user -N root nobody)
+    (! userdbctl user --with-dropin=no dropinuser)
+    (! userdbctl user --with-dropin=no 2000000)
 
-userdbctl group
-userdbctl group -S
-userdbctl group -IS
-userdbctl group -R
-userdbctl group --disposition=regular --disposition=intrinsic
-userdbctl group kkkk -z
-userdbctl group --uid-min=100 --uid-max=100
-userdbctl group -B
-userdbctl group testuser
-userdbctl group root
-userdbctl group testuser root
-userdbctl group -j testuser root | jq
-# Check only GID for the nobody group, since the name is build-configurable
-userdbctl group --with-nss=no --synthesize=yes
-userdbctl group --with-nss=no --synthesize=yes 0 root 65534
-userdbctl group dropingroup
-userdbctl group 1000000
-userdbctl group --with-nss=no --with-varlink=no --synthesize=no --multiplexer=no dropingroup
-userdbctl group --with-nss=no 1000000
-(! userdbctl group '')
-(! userdbctl group 🐱)
-(! userdbctl group 🐱 '' bar)
-(! userdbctl group i-do-not-exist)
-(! userdbctl group root i-do-not-exist testuser)
-(! userdbctl group --with-nss=no --synthesize=no 0 root 65534)
-(! userdbctl group --with-dropin=no dropingroup)
-(! userdbctl group --with-dropin=no 1000000)
+    userdbctl group
+    userdbctl group -S
+    userdbctl group -IS
+    userdbctl group -R
+    userdbctl group --disposition=regular --disposition=intrinsic
+    userdbctl group kkkk -z
+    userdbctl group --uid-min=100 --uid-max=100
+    userdbctl group -B
+    userdbctl group testuser
+    userdbctl group root
+    userdbctl group testuser root
+    userdbctl group -j testuser root | jq
+    # Check only GID for the nobody group, since the name is build-configurable
+    userdbctl group --with-nss=no --synthesize=yes
+    userdbctl group --with-nss=no --synthesize=yes 0 root 65534
+    userdbctl group dropingroup
+    userdbctl group 1000000
+    userdbctl group --with-nss=no --with-varlink=no --synthesize=no --multiplexer=no dropingroup
+    userdbctl group --with-nss=no 1000000
+    (! userdbctl group '')
+    (! userdbctl group 🐱)
+    (! userdbctl group 🐱 '' bar)
+    (! userdbctl group i-do-not-exist)
+    (! userdbctl group root i-do-not-exist testuser)
+    (! userdbctl group --with-nss=no --synthesize=no 0 root 65534)
+    (! userdbctl group --with-dropin=no dropingroup)
+    (! userdbctl group --with-dropin=no 1000000)
 
-userdbctl users-in-group
-userdbctl users-in-group testuser
-userdbctl users-in-group testuser root
-userdbctl users-in-group -j testuser root | jq
-userdbctl users-in-group 🐱
-(! userdbctl users-in-group '')
-(! userdbctl users-in-group foo '' bar)
+    userdbctl users-in-group
+    userdbctl users-in-group testuser
+    userdbctl users-in-group testuser root
+    userdbctl users-in-group -j testuser root | jq
+    userdbctl users-in-group 🐱
+    (! userdbctl users-in-group '')
+    (! userdbctl users-in-group foo '' bar)
 
-userdbctl groups-of-user
-userdbctl groups-of-user testuser
-userdbctl groups-of-user testuser root
-userdbctl groups-of-user -j testuser root | jq
-userdbctl groups-of-user 🐱
-(! userdbctl groups-of-user '')
-(! userdbctl groups-of-user foo '' bar)
+    userdbctl groups-of-user
+    userdbctl groups-of-user testuser
+    userdbctl groups-of-user testuser root
+    userdbctl groups-of-user -j testuser root | jq
+    userdbctl groups-of-user 🐱
+    (! userdbctl groups-of-user '')
+    (! userdbctl groups-of-user foo '' bar)
 
-userdbctl services
-userdbctl services -j | jq
+    userdbctl services
+    userdbctl services -j | jq
 
-varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"testuser","service":"io.systemd.Multiplexer"}'
-varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"root","service":"io.systemd.Multiplexer"}'
-varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"dropinuser","service":"io.systemd.Multiplexer"}'
-varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"uid":2000000,"service":"io.systemd.Multiplexer"}'
-(! varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"","service":"io.systemd.Multiplexer"}')
-(! varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"🐱","service":"io.systemd.Multiplexer"}')
-(! varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"i-do-not-exist","service":"io.systemd.Multiplexer"}')
+    varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"testuser","service":"io.systemd.Multiplexer"}'
+    varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"root","service":"io.systemd.Multiplexer"}'
+    varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"dropinuser","service":"io.systemd.Multiplexer"}'
+    varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"uid":2000000,"service":"io.systemd.Multiplexer"}'
+    (! varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"","service":"io.systemd.Multiplexer"}')
+    (! varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"🐱","service":"io.systemd.Multiplexer"}')
+    (! varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"i-do-not-exist","service":"io.systemd.Multiplexer"}')
 
-userdbctl ssh-authorized-keys dropinuser | tee /tmp/authorized-keys
-grep "ssh-ed25519" /tmp/authorized-keys
-grep "ecdsa-sha2-nistp256" /tmp/authorized-keys
-echo "my-top-secret-key 🐱" >/tmp/my-top-secret-key
-userdbctl ssh-authorized-keys dropinuser --chain /usr/bin/cat /tmp/my-top-secret-key | tee /tmp/authorized-keys
-grep "ssh-ed25519" /tmp/authorized-keys
-grep "ecdsa-sha2-nistp256" /tmp/authorized-keys
-grep "my-top-secret-key 🐱" /tmp/authorized-keys
-(! userdbctl ssh-authorized-keys 🐱)
-(! userdbctl ssh-authorized-keys dropin-user --chain)
-(! userdbctl ssh-authorized-keys dropin-user --chain '')
-(! SYSTEMD_LOG_LEVEL=debug userdbctl ssh-authorized-keys dropin-user --chain /usr/bin/false)
+    userdbctl ssh-authorized-keys dropinuser | tee /tmp/authorized-keys
+    grep "ssh-ed25519" /tmp/authorized-keys
+    grep "ecdsa-sha2-nistp256" /tmp/authorized-keys
+    echo "my-top-secret-key 🐱" >/tmp/my-top-secret-key
+    userdbctl ssh-authorized-keys dropinuser --chain /usr/bin/cat /tmp/my-top-secret-key | tee /tmp/authorized-keys
+    grep "ssh-ed25519" /tmp/authorized-keys
+    grep "ecdsa-sha2-nistp256" /tmp/authorized-keys
+    grep "my-top-secret-key 🐱" /tmp/authorized-keys
+    (! userdbctl ssh-authorized-keys 🐱)
+    (! userdbctl ssh-authorized-keys dropin-user --chain)
+    (! userdbctl ssh-authorized-keys dropin-user --chain '')
+    (! SYSTEMD_LOG_LEVEL=debug userdbctl ssh-authorized-keys dropin-user --chain /usr/bin/false)
 
-(! userdbctl '')
-for opt in json multiplexer output synthesize with-dropin with-nss with-varlink; do
-    (! userdbctl "--$opt=''")
-    (! userdbctl "--$opt='🐱'")
-    (! userdbctl "--$opt=foo")
-    (! userdbctl "--$opt=foo" "--$opt=''" "--$opt=🐱")
-done
+    (! userdbctl '')
+    for opt in json multiplexer output synthesize with-dropin with-nss with-varlink; do
+        (! userdbctl "--$opt=''")
+        (! userdbctl "--$opt='🐱'")
+        (! userdbctl "--$opt=foo")
+        (! userdbctl "--$opt=foo" "--$opt=''" "--$opt=🐱")
+    done
+}
 
-# FIXME: sshd seems to crash inside asan currently, skip the actual ssh test hence
-if command -v ssh >/dev/null && command -v sshd >/dev/null && ! [[ -v ASAN_OPTIONS ]]; then
-    at_exit() {
-        set +e
+cleanup_ssh() (
+    set +e
 
-        systemctl is-active -q mysshserver.socket && systemctl stop mysshserver.socket
-        rm -f /tmp/homed.id_ecdsa /run/systemd/system/mysshserver{@.service,.socket}
-        systemctl daemon-reload
-        wait_for_state homedsshtest inactive
-        homectl remove homedsshtest
-        for dir in /etc /usr/lib; do
-            if [[ -f "$dir/pam.d/sshd.bak" ]]; then
-                mv "$dir/pam.d/sshd.bak" "$dir/pam.d/sshd"
-            fi
-        done
-    }
+    systemctl is-active -q mysshserver.socket && systemctl stop mysshserver.socket
+    rm -f /tmp/homed.id_ecdsa /run/systemd/system/mysshserver{@.service,.socket}
+    systemctl daemon-reload
+    wait_for_state homedsshtest inactive
+    homectl remove homedsshtest
+    for dir in /etc /usr/lib; do
+        if [[ -f "$dir/pam.d/sshd.bak" ]]; then
+            mv "$dir/pam.d/sshd.bak" "$dir/pam.d/sshd"
+        fi
+    done
+)
 
-    trap at_exit EXIT
+testcase_ssh() {
+    # FIXME: sshd seems to crash inside asan currently, skip the actual ssh test hence
+    if [[ -v ASAN_OPTIONS ]]; then
+        return 0
+    fi
+
+    # 'ssh homedsshtest@localhost' requires systemd NSS module.
+    if ! check_nss_module systemd; then
+        return 0
+    fi
+
+    if ! command -v ssh >/dev/null || ! command -v sshd >/dev/null; then
+        echo "ssh/sshd is not installed, skipping the ssh test."
+        return 0
+    fi
+
+    trap cleanup_ssh RETURN ERR EXIT
 
     # Test that SSH logins work with delayed unlocking
     ssh-keygen -N '' -C '' -t ecdsa -f /tmp/homed.id_ecdsa
-    NEWPASSWORD=hunter4711 homectl create \
-                       --disk-size=min \
-                       --luks-discard=yes \
-                       --luks-pbkdf-type=pbkdf2 \
-                       --luks-pbkdf-time-cost=1ms \
-                       --rate-limit-interval=1s \
-                       --rate-limit-burst=1000 \
-                       --enforce-password-policy=no \
-                       --ssh-authorized-keys=@/tmp/homed.id_ecdsa.pub \
-                       --stop-delay=0 \
-                       homedsshtest
+    NEWPASSWORD=hunter4711 \
+        homectl create \
+        --disk-size=min \
+        --luks-discard=yes \
+        --luks-pbkdf-type=pbkdf2 \
+        --luks-pbkdf-time-cost=1ms \
+        --rate-limit-interval=1s \
+        --rate-limit-burst=1000 \
+        --enforce-password-policy=no \
+        --ssh-authorized-keys=@/tmp/homed.id_ecdsa.pub \
+        --stop-delay=0 \
+        homedsshtest
     homectl inspect homedsshtest
 
     mkdir -p /etc/ssh
@@ -628,82 +682,96 @@ EOF
     ssh -t -t -4 -p 4711 -i /tmp/homed.id_ecdsa \
         -o "SetEnv PASSWORD=hunter4711" -o "StrictHostKeyChecking no" \
         homedsshtest@localhost env
+}
 
-    trap - EXIT
-    at_exit
-fi
+testcase_alias() {
+    NEWPASSWORD=hunter4711 homectl create aliastest --storage=directory --alias=aliastest2 --alias=aliastest3 --realm=myrealm
 
-NEWPASSWORD=hunter4711 homectl create aliastest --storage=directory --alias=aliastest2 --alias=aliastest3 --realm=myrealm
+    homectl inspect aliastest
+    homectl inspect aliastest2
+    homectl inspect aliastest3
+    homectl inspect aliastest@myrealm
+    homectl inspect aliastest2@myrealm
+    homectl inspect aliastest3@myrealm
 
-homectl inspect aliastest
-homectl inspect aliastest2
-homectl inspect aliastest3
-homectl inspect aliastest@myrealm
-homectl inspect aliastest2@myrealm
-homectl inspect aliastest3@myrealm
+    userdbctl user aliastest
+    userdbctl user aliastest2
+    userdbctl user aliastest3
+    userdbctl user aliastest@myrealm
+    userdbctl user aliastest2@myrealm
+    userdbctl user aliastest3@myrealm
 
-userdbctl user aliastest
-userdbctl user aliastest2
-userdbctl user aliastest3
-userdbctl user aliastest@myrealm
-userdbctl user aliastest2@myrealm
-userdbctl user aliastest3@myrealm
-
-getent passwd aliastest
-getent passwd aliastest2
-getent passwd aliastest3
-getent passwd aliastest@myrealm
-getent passwd aliastest2@myrealm
-getent passwd aliastest3@myrealm
-
-homectl remove aliastest
-
-NEWPASSWORD=quux homectl create tmpfsquota --storage=subvolume --dev-shm-limit=50K --tmp-limit=50K -P
-for p in /dev/shm /tmp; do
-    if findmnt -n -o options "$p" | grep -q usrquota; then
-        # Check if we can display the quotas. If we cannot, than it's likely
-        # that PID1 was also not able to set the limits and we should not fail
-        # in the tests below.
-        /usr/lib/systemd/tests/unit-tests/manual/test-display-quota tmpfsquota "$p" || set +e
-
-        run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u tmpfsquota dd if=/dev/zero of="$p/quotatestfile1" bs=1024 count=30
-        (! run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u tmpfsquota dd if=/dev/zero of="$p/quotatestfile2" bs=1024 count=30)
-        run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u tmpfsquota rm "$p/quotatestfile1" "$p/quotatestfile2"
-        run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u tmpfsquota dd if=/dev/zero of="$p/quotatestfile1" bs=1024 count=30
-        run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u tmpfsquota rm "$p/quotatestfile1"
-
-        set -e
+    if check_nss_module systemd; then
+        getent passwd aliastest
+        getent passwd aliastest2
+        getent passwd aliastest3
+        getent passwd aliastest@myrealm
+        getent passwd aliastest2@myrealm
+        getent passwd aliastest3@myrealm
     fi
-done
 
-systemctl stop user@"$(id -u tmpfsquota)".service
-wait_for_state tmpfsquota inactive
-homectl remove tmpfsquota
+    homectl remove aliastest
+}
 
-NEWPASSWORD=quux homectl create subareatest --storage=subvolume -P
-run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest mkdir Areas
-run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest cp -av /etc/skel Areas/furb
-run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest cp -av /etc/skel Areas/molb
-run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest ln -s /home/srub Areas/srub
-run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest ln -s /root Areas/root
+testcase_quota() {
+    # 'run0 -u' requires systemd NSS module.
+    if ! check_nss_module systemd; then
+        return 0
+    fi
 
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest sh -c 'echo $HOME')" = "/home/subareatest"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest sh -c 'echo x$XDG_AREA')" = "x"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest sh -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb sh -c 'echo $HOME')" = "/home/subareatest/Areas/furb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb sh -c 'echo $XDG_AREA')" = "furb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb sh -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/furb"
+    NEWPASSWORD=quux homectl create tmpfsquota --storage=subvolume --dev-shm-limit=50K --tmp-limit=50K -P
+    for p in /dev/shm /tmp; do
+        if findmnt -n -o options "$p" | grep -q usrquota; then
+            # Check if we can display the quotas. If we cannot, than it's likely
+            # that PID1 was also not able to set the limits and we should not fail
+            # in the tests below.
+            /usr/lib/systemd/tests/unit-tests/manual/test-display-quota tmpfsquota "$p" || set +e
 
-PASSWORD=quux homectl update subareatest --default-area=molb
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest sh -c 'echo $HOME')" = "/home/subareatest/Areas/molb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest sh -c 'echo $XDG_AREA')" = "molb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest sh -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/molb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb sh -c 'echo $HOME')" = "/home/subareatest/Areas/furb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb sh -c 'echo $XDG_AREA')" = "furb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb sh -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/furb"
+            run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u tmpfsquota dd if=/dev/zero of="$p/quotatestfile1" bs=1024 count=30
+            (! run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u tmpfsquota dd if=/dev/zero of="$p/quotatestfile2" bs=1024 count=30)
+            run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u tmpfsquota rm "$p/quotatestfile1" "$p/quotatestfile2"
+            run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u tmpfsquota dd if=/dev/zero of="$p/quotatestfile1" bs=1024 count=30
+            run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u tmpfsquota rm "$p/quotatestfile1"
 
-# Install a PK rule that allows 'subareatest' user to invoke run0 without password, just for testing
-cat >/usr/share/polkit-1/rules.d/subareatest.rules <<'EOF'
+            set -e
+        fi
+    done
+
+    systemctl stop user@"$(id -u tmpfsquota)".service
+    wait_for_state tmpfsquota inactive
+    homectl remove tmpfsquota
+}
+
+testcase_subarea() {
+    # 'run0 -u' requires systemd NSS module.
+    if ! check_nss_module systemd; then
+        return 0
+    fi
+
+    NEWPASSWORD=quux homectl create subareatest --storage=subvolume -P
+    run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest mkdir Areas
+    run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest cp -av /etc/skel Areas/furb
+    run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest cp -av /etc/skel Areas/molb
+    run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest ln -s /home/srub Areas/srub
+    run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest ln -s /root Areas/root
+
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest bash -c 'echo $HOME')" = "/home/subareatest"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest bash -c 'echo x$XDG_AREA')" = "x"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $HOME')" = "/home/subareatest/Areas/furb"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $XDG_AREA')" = "furb"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/furb"
+
+    PASSWORD=quux homectl update subareatest --default-area=molb
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest bash -c 'echo $HOME')" = "/home/subareatest/Areas/molb"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest bash -c 'echo $XDG_AREA')" = "molb"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/molb"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $HOME')" = "/home/subareatest/Areas/furb"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $XDG_AREA')" = "furb"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/furb"
+
+    # Install a PK rule that allows 'subareatest' user to invoke run0 without password, just for testing
+    cat >/usr/share/polkit-1/rules.d/subareatest.rules <<'EOF'
 polkit.addRule(function(action, subject) {
     if (action.id == "org.freedesktop.systemd1.manage-units" &&
         subject.user == "subareatest") {
@@ -712,137 +780,174 @@ polkit.addRule(function(action, subject) {
 });
 EOF
 
-# Test "recursive" operation
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb sh -c 'echo $HOME')" = "/home/subareatest/Areas/molb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb sh -c 'echo $XDG_AREA')" = "molb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb sh -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/molb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb sh -c 'echo $HOME')" = "/home/subareatest/Areas/furb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb sh -c 'echo $XDG_AREA')" = "furb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb sh -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/furb"
+    # Test "recursive" operation
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb bash -c 'echo $HOME')" = "/home/subareatest/Areas/molb"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb bash -c 'echo $XDG_AREA')" = "molb"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/molb"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $HOME')" = "/home/subareatest/Areas/furb"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $XDG_AREA')" = "furb"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/furb"
 
-# Test symlinked area
-mkdir -p /home/srub
-chown subareatest:subareatest /home/srub
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=srub sh -c 'echo $HOME')" = "/home/srub"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=srub sh -c 'echo $XDG_AREA')" = "srub"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=srub sh -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/srub"
+    # Test symlinked area
+    mkdir -p /home/srub
+    chown subareatest:subareatest /home/srub
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=srub bash -c 'echo $HOME')" = "/home/srub"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=srub bash -c 'echo $XDG_AREA')" = "srub"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=srub bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/srub"
 
-# Verify that login into an area not owned by target user will be redirected to main area
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=root sh -c 'echo $HOME')" = "/home/subareatest"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=root sh -c 'echo x$XDG_AREA')" = "x"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=root sh -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)"
+    # Verify that login into an area not owned by target user will be redirected to main area
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=root bash -c 'echo $HOME')" = "/home/subareatest"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=root bash -c 'echo x$XDG_AREA')" = "x"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=root bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)"
 
-systemctl stop user@"$(id -u subareatest)".service
+    systemctl stop user@"$(id -u subareatest)".service
 
-wait_for_state subareatest inactive
-homectl remove subareatest
+    wait_for_state subareatest inactive
+    homectl remove subareatest
+}
 
-# Test signing key logic
-homectl list-signing-keys | grep -q local.public
-(! (homectl list-signing-keys | grep -q signtest.public))
+testcase_sign() {
+    # Test signing key logic
+    homectl list-signing-keys | grep -q local.public
+    (! (homectl list-signing-keys | grep -q signtest.public))
 
-IDENTITY='{"userName":"signtest","storage":"directory","disposition":"regular","privileged":{"hashedPassword":["$y$j9T$I5Wxfm.fyg.RRWlgWw.rI1$gnQqGtbpPexqxZJkWMq8FxQi5Swc.CWeKtM8LwvEUB6"]},"enforcePasswordPolicy":false,"lastChangeUSec":1740677608017608,"lastPasswordChangeUSec":1740677608017608,"signature":[{"data":"Gl4wtc0sMjVnsH6FQwG/0M+x0nLI5cvvdtSSCttUu1gNtXqYn0UI4wZi/7zX35ERht6XHWDlP4d6V8HiAst4Dg==","key":"-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA6uvVaP1vh7O6nIbiOcvyIHRl4ihYSs0R7ctxtz2Zu7E=\n-----END PUBLIC KEY-----\n"}],"secret":{"password":["test"]}}'
+    if built_with_musl; then
+        # FIXME: musl does not support yescrypt. Use SHA512 and update signature.
+        return 0
+    fi
 
-# Try with stripping the foreign signature first, this should just work
-echo "$IDENTITY" | homectl create -P --identity=- --seize=yes
-wait_for_state signtest inactive
-homectl remove signtest
+    print_identity() {
+        cat <<\EOF
+{
+    "userName" : "signtest",
+    "storage" : "directory",
+    "disposition" : "regular",
+    "privileged" : {
+        "hashedPassword" : [
+            "$y$j9T$I5Wxfm.fyg.RRWlgWw.rI1$gnQqGtbpPexqxZJkWMq8FxQi5Swc.CWeKtM8LwvEUB6"
+        ]
+    },
+    "enforcePasswordPolicy" : false,
+    "lastChangeUSec" : 1740677608017608,
+    "lastPasswordChangeUSec" : 1740677608017608,
+    "signature" : [
+        {
+            "data" : "Gl4wtc0sMjVnsH6FQwG/0M+x0nLI5cvvdtSSCttUu1gNtXqYn0UI4wZi/7zX35ERht6XHWDlP4d6V8HiAst4Dg==",
+            "key" : "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA6uvVaP1vh7O6nIbiOcvyIHRl4ihYSs0R7ctxtz2Zu7E=\n-----END PUBLIC KEY-----\n"
+        }
+    ],
+    "secret" : {
+        "password" : [
+            "test"
+        ]
+    }
+}
+EOF
+    }
 
-# No try again, and don't strip the signature. It will be refused.
-(! (echo "$IDENTITY" | homectl create -P --identity=- --seize=no))
+    # Try with stripping the foreign signature first, this should just work
+    print_identity | homectl create -P --identity=- --seize=yes
+    wait_for_state signtest inactive
+    homectl remove signtest
 
-print_public_key() {
-    cat <<EOF
+    # No try again, and don't strip the signature. It will be refused.
+    (! (print_identity | homectl create -P --identity=- --seize=no))
+
+    print_public_key() {
+        cat <<EOF
 -----BEGIN PUBLIC KEY-----
 MCowBQYDK2VwAyEA6uvVaP1vh7O6nIbiOcvyIHRl4ihYSs0R7ctxtz2Zu7E=
 -----END PUBLIC KEY-----
 EOF
+    }
+
+    # Let's now add the signing key
+    print_public_key | homectl add-signing-key --key-name=signtest.public
+    homectl get-signing-key signtest.public | cmp - <(print_public_key)
+    homectl list-signing-keys | grep -q local.public
+    homectl list-signing-keys | grep -q signtest.public
+
+    # Now create the account with this, it should work now
+    print_identity | homectl create -P --identity=- --seize=no
+
+    # Verify we can log in
+    PASSWORD="test" homectl with signtest true
+
+    # Remove the key, and check again ,should fail now
+    wait_for_state signtest inactive
+    homectl remove-signing-key signtest.public
+    wait_for_state signtest inactive
+    (! PASSWORD="test" homectl with signtest true)
+
+    # Verify key is really gone
+    homectl list-signing-keys | grep -q local.public
+    (! (homectl list-signing-keys | grep -q signtest.public))
+
+    # Test unregister + adopt
+    mkdir /home/elsewhere
+    mv /home/signtest.homedir /home/elsewhere/
+    wait_for_state signtest absent
+    homectl unregister signtest
+    print_public_key | homectl add-signing-key --key-name=signtest.public
+    homectl adopt /home/elsewhere/signtest.homedir
+    PASSWORD="test" homectl with signtest true
+
+    # Test register
+    wait_for_state signtest inactive
+    homectl unregister signtest
+    homectl register /home/elsewhere/signtest.homedir/.identity
+    wait_for_state signtest absent
+    homectl unregister signtest
+
+    # Test automatic fixation for anything in /home/
+    mv /home/elsewhere/signtest.homedir /home
+    rmdir /home/elsewhere
+    wait_for_exist signtest
+    PASSWORD="test" homectl with signtest true
+
+    # add signing key via credential
+    wait_for_state signtest inactive
+    homectl remove-signing-key signtest.public
+    (! (homectl list-signing-keys | grep -q signtest.public))
+    systemd-run --wait -p "SetCredential=home.add-signing-key.signtest.public:$(print_public_key)" homectl firstboot
+    homectl list-signing-keys | grep -q signtest.public
+
+    # register user via credential
+    mkdir /home/elsewhere2
+    mv /home/signtest.homedir /home/elsewhere2/
+    wait_for_state signtest absent
+    homectl unregister signtest
+    systemd-run --wait -p "LoadCredential=home.register.signtest:/home/elsewhere2/signtest.homedir/.identity" homectl firstboot
+    homectl inspect signtest
+    wait_for_state signtest absent
+    homectl unregister signtest
+    mv /home/elsewhere2/signtest.homedir /home/
+    rmdir /home/elsewhere2
+
+    # Remove it all again
+    wait_for_exist signtest
+    homectl remove-signing-key signtest.public
+    homectl remove signtest
 }
 
-# Let's now add the signing key
-print_public_key | homectl add-signing-key --key-name=signtest.public
-homectl get-signing-key signtest.public | cmp - <(print_public_key)
-homectl list-signing-keys | grep -q local.public
-homectl list-signing-keys | grep -q signtest.public
+testcase_match() {
+    # Test positive and negative matching
+    NEWPASSWORD=test homectl create --storage=directory --nice=5 -P matchtest
+    homectl inspect matchtest
+    homectl inspect matchtest | grep "Nice: 5"
+    PASSWORD=test homectl update -N --nice=7 -T --nice=3 matchtest
+    homectl inspect matchtest
+    homectl inspect matchtest | grep "Nice: 3"
+    PASSWORD=test homectl update -A --default-area=quux1 matchtest
+    homectl inspect matchtest
+    homectl inspect matchtest | grep "Area: quux1"
+    PASSWORD=test homectl update -N --default-area=quux2 matchtest
+    homectl inspect matchtest
+    homectl inspect matchtest | grep "Area: quux1"
+    PASSWORD=test homectl update -T --default-area=quux3 matchtest
+    homectl inspect matchtest
+    homectl inspect matchtest | grep "Area: quux3"
+    homectl remove matchtest
+}
 
-# Now create the account with this, it should work now
-echo "$IDENTITY" | homectl create -P --identity=- --seize=no
-
-# Verify we can log in
-PASSWORD="test" homectl with signtest true
-
-# Remove the key, and check again ,should fail now
-wait_for_state signtest inactive
-homectl remove-signing-key signtest.public
-wait_for_state signtest inactive
-(! PASSWORD="test" homectl with signtest true)
-
-# Verify key is really gone
-homectl list-signing-keys | grep -q local.public
-(! (homectl list-signing-keys | grep -q signtest.public))
-
-# Test unregister + adopt
-mkdir /home/elsewhere
-mv /home/signtest.homedir /home/elsewhere/
-wait_for_state signtest absent
-homectl unregister signtest
-print_public_key | homectl add-signing-key --key-name=signtest.public
-homectl adopt /home/elsewhere/signtest.homedir
-PASSWORD="test" homectl with signtest true
-
-# Test register
-wait_for_state signtest inactive
-homectl unregister signtest
-homectl register /home/elsewhere/signtest.homedir/.identity
-wait_for_state signtest absent
-homectl unregister signtest
-
-# Test automatic fixation for anything in /home/
-mv /home/elsewhere/signtest.homedir /home
-rmdir /home/elsewhere
-wait_for_exist signtest
-PASSWORD="test" homectl with signtest true
-
-# add signing key via credential
-wait_for_state signtest inactive
-homectl remove-signing-key signtest.public
-(! (homectl list-signing-keys | grep -q signtest.public))
-systemd-run --wait -p "SetCredential=home.add-signing-key.signtest.public:$(print_public_key)" homectl firstboot
-homectl list-signing-keys | grep -q signtest.public
-
-# register user via credential
-mkdir /home/elsewhere2
-mv /home/signtest.homedir /home/elsewhere2/
-wait_for_state signtest absent
-homectl unregister signtest
-systemd-run --wait -p "LoadCredential=home.register.signtest:/home/elsewhere2/signtest.homedir/.identity" homectl firstboot
-homectl inspect signtest
-wait_for_state signtest absent
-homectl unregister signtest
-mv /home/elsewhere2/signtest.homedir /home/
-rmdir /home/elsewhere2
-
-# Remove it all again
-wait_for_exist signtest
-homectl remove-signing-key signtest.public
-homectl remove signtest
-
-# Test positive and negative matching
-NEWPASSWORD=test homectl create --storage=directory --nice=5 -P matchtest
-homectl inspect matchtest
-homectl inspect matchtest | grep "Nice: 5"
-PASSWORD=test homectl update -N --nice=7 -T --nice=3 matchtest
-homectl inspect matchtest
-homectl inspect matchtest | grep "Nice: 3"
-PASSWORD=test homectl update -A --default-area=quux1 matchtest
-homectl inspect matchtest
-homectl inspect matchtest | grep "Area: quux1"
-PASSWORD=test homectl update -N --default-area=quux2 matchtest
-homectl inspect matchtest
-homectl inspect matchtest | grep "Area: quux1"
-PASSWORD=test homectl update -T --default-area=quux3 matchtest
-homectl inspect matchtest
-homectl inspect matchtest | grep "Area: quux3"
-homectl remove matchtest
-
-touch /testok
+run_testcases
diff --git a/test/units/TEST-50-DISSECT.dissect.sh b/test/units/TEST-50-DISSECT.dissect.sh
index 6ac4263dff..5bd95fbe0d 100755
--- a/test/units/TEST-50-DISSECT.dissect.sh
+++ b/test/units/TEST-50-DISSECT.dissect.sh
@@ -9,6 +9,14 @@ set -o pipefail
 # shellcheck source=test/units/util.sh
 . "$(dirname "$0")"/util.sh
 
+. /etc/os-release
+if [[ "${ID_LIKE:-}" == alpine ]]; then
+    # Alpine/postmarketOS builds libdevmapper and so on without systemd support, and seems to not wait for
+    # uevents for dm-X devices being processed by systemd-udevd. That causes a significant issue in
+    # dissect-image.c especially when multiple dm-X devices are activated/deactivated in parallel.
+    exit 0
+fi
+
 systemd-dissect --json=short "$MINIMAL_IMAGE.raw" | \
     grep -q -F '{"rw":"ro","designator":"root","partition_uuid":null,"partition_label":null,"fstype":"squashfs","architecture":null,"verity":"external"'
 systemd-dissect "$MINIMAL_IMAGE.raw" | grep -q -F "MARKER=1"
@@ -363,7 +371,7 @@ Type=notify
 RemainAfterExit=yes
 MountAPIVFS=yes
 PrivateTmp=yes
-ExecStart=sh -c ' \\
+ExecStart=bash -c ' \\
     systemd-notify --ready; \\
     while [ ! -f /tmp/img/usr/lib/os-release ] || ! grep -q -F MARKER /tmp/img/usr/lib/os-release; do \\
         sleep 0.1; \\
diff --git a/test/units/TEST-50-DISSECT.mountfsd.sh b/test/units/TEST-50-DISSECT.mountfsd.sh
index a70cf6df0f..5985cbdb79 100755
--- a/test/units/TEST-50-DISSECT.mountfsd.sh
+++ b/test/units/TEST-50-DISSECT.mountfsd.sh
@@ -76,7 +76,7 @@ if [ "$VERITY_SIG_SUPPORTED" -eq 1 ]; then
     systemd-run -M testuser@ --user --pipe --wait \
         --property RootImage="$MINIMAL_IMAGE.raw" \
         --property ExtensionImages=/tmp/app0.raw \
-        sh -c "test -e \"/dev/mapper/${MINIMAL_IMAGE_ROOTHASH}-verity\" && test -e \"/dev/mapper/$(</tmp/app0.roothash)-verity\""
+        bash -c "test -e \"/dev/mapper/${MINIMAL_IMAGE_ROOTHASH}-verity\" && test -e \"/dev/mapper/$(</tmp/app0.roothash)-verity\""
 
     # Without a signature this should not work, as mountfsd should reject it, even if we explicitly ask to
     # trust it
@@ -84,12 +84,12 @@ if [ "$VERITY_SIG_SUPPORTED" -eq 1 ]; then
     (! systemd-run -M testuser@ --user --pipe --wait \
         --property RootImage="$MINIMAL_IMAGE.raw" \
         --property ExtensionImages=/tmp/app0.raw \
-        sh -c "test -e \"/dev/mapper/${MINIMAL_IMAGE_ROOTHASH}-verity\" && test -e \"/dev/mapper/$(</tmp/app0.roothash)-verity\"")
+        bash -c "test -e \"/dev/mapper/${MINIMAL_IMAGE_ROOTHASH}-verity\" && test -e \"/dev/mapper/$(</tmp/app0.roothash)-verity\"")
     (! systemd-run -M testuser@ --user --pipe --wait \
         --property RootImage="$MINIMAL_IMAGE.raw" \
         --property ExtensionImages=/tmp/app0.raw \
         --property ExtensionImagePolicy=root=verity+signed+absent:usr=verity+signed+absent \
-        sh -c "test -e \"/dev/mapper/${MINIMAL_IMAGE_ROOTHASH}-verity\" && test -e \"/dev/mapper/$(</tmp/app0.roothash)-verity\"")
+        bash -c "test -e \"/dev/mapper/${MINIMAL_IMAGE_ROOTHASH}-verity\" && test -e \"/dev/mapper/$(</tmp/app0.roothash)-verity\"")
     mv /tmp/app0.roothash.p7s.bak /tmp/app0.roothash.p7s
 fi
 
diff --git a/test/units/TEST-64-UDEV-STORAGE.sh b/test/units/TEST-64-UDEV-STORAGE.sh
index 88c89c5191..5956e14aec 100755
--- a/test/units/TEST-64-UDEV-STORAGE.sh
+++ b/test/units/TEST-64-UDEV-STORAGE.sh
@@ -266,6 +266,12 @@ EOF
 testcase_multipath_basic_failover() {
     local dmpath i path wwid
 
+    . /etc/os-release
+    if [[ "${ID_LIKE:-}" == "alpine" ]]; then
+        echo "multipath on alpine/postmarketos is broken, skipping the test" | tee --append /skipped
+        exit 77
+    fi
+
     # Configure multipath
     cat >/etc/multipath.conf <<\EOF
 defaults {
@@ -631,8 +637,8 @@ testcase_lvm_basic() {
     )
 
     . /etc/os-release
-    if [[ "$ID" == "ubuntu" ]]; then
-        echo "LVM on Ubuntu is broken, skipping the test" | tee --append /skipped
+    if [[ "$ID" == "ubuntu" || "${ID_LIKE:-}" == "alpine" ]]; then
+        echo "LVM on Ubuntu/alpine/postmarketos is broken, skipping the test" | tee --append /skipped
         exit 77
     fi
 
diff --git a/test/units/TEST-65-ANALYZE.sh b/test/units/TEST-65-ANALYZE.sh
index f368d21653..af73c7dc7c 100755
--- a/test/units/TEST-65-ANALYZE.sh
+++ b/test/units/TEST-65-ANALYZE.sh
@@ -79,8 +79,12 @@ systemd-analyze dump "*.socket" "*.service" aaaaaaa ... >/dev/null
 systemd-analyze dump systemd-journald.service >/dev/null
 (! systemd-analyze dump "")
 (! systemd-analyze dump --global systemd-journald.service)
-# malloc
-systemd-analyze malloc >/dev/null
+# malloc (supported only when built with glibc)
+if built_with_musl; then
+    (! systemd-analyze malloc)
+else
+    systemd-analyze malloc >/dev/null
+fi
 (! systemd-analyze malloc --global)
 # unit-files
 systemd-analyze unit-files >/dev/null
@@ -1146,7 +1150,7 @@ Description=Test unit for systemd-analyze unit-shell
 [Service]
 Type=notify
 NotifyAccess=all
-ExecStart=sh -c "echo 'Hello from test unit' >/tmp/testfile; systemd-notify --ready; sleep infinity"
+ExecStart=bash -c "echo 'Hello from test unit' >/tmp/testfile; systemd-notify --ready; sleep infinity"
 PrivateTmp=disconnected
 EOF
 # Start the service
diff --git a/test/units/TEST-67-INTEGRITY.sh b/test/units/TEST-67-INTEGRITY.sh
index c015703666..0919f20248 100755
--- a/test/units/TEST-67-INTEGRITY.sh
+++ b/test/units/TEST-67-INTEGRITY.sh
@@ -2,6 +2,8 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 set -euxo pipefail
 
+. /etc/os-release
+
 DM_NAME="integrity_test"
 DM_NODE="/dev/mapper/${DM_NAME}"
 DM_SERVICE="systemd-integritysetup@${DM_NAME}.service"
@@ -117,6 +119,18 @@ EOF
 }
 
 for a in crc32c crc32 xxhash64 sha1 sha256; do
+    if [[ "$a" == crc32 && "${ID_LIKE:-}" == alpine ]]; then
+        # crc32 is not supported on alpine/postmarketos ??
+        # --------
+        # [   22.419458] TEST-67-INTEGRITY.sh[3085]: + integritysetup format /dev/loop0 --batch-mode -I crc32 ''
+        # [   22.433168] kernel: device-mapper: table: 253:0: integrity: Invalid internal hash (-ENOENT)
+        # [   22.433220] TEST-67-INTEGRITY.sh[3475]: device-mapper: reload ioctl on temporary-cryptsetup-6b3b80ef-6854-4102-8239-6360f15af0c3 (253:0) failed: No such file or directory
+        # [   22.433220] TEST-67-INTEGRITY.sh[3475]: Cannot format integrity for device /dev/loop0.
+        # [   22.433835] kernel: device-mapper: ioctl: error adding target to table
+        # --------
+        continue;
+    fi
+
     test_one "$a" 0
     test_one "$a" 1
 done
diff --git a/test/units/TEST-70-TPM2.tpm2-setup.sh b/test/units/TEST-70-TPM2.tpm2-setup.sh
index 72f7841858..23cb85e30b 100755
--- a/test/units/TEST-70-TPM2.tpm2-setup.sh
+++ b/test/units/TEST-70-TPM2.tpm2-setup.sh
@@ -11,6 +11,16 @@ if [[ ! -x "${SD_TPM2SETUP:?}" ]]; then
     exit 0
 fi
 
+. /etc/os-release
+if [[ "${ID_LIKE:-}" == alpine ]]; then
+    # For some unknown reasons, the test fails with the following:
+    # --------
+    # Couldn't find signature for this PCR bank, PCR index and public key.
+    # Failed to unseal secret using TPM2: No such device or address
+    # --------
+    exit 0
+fi
+
 "$SD_TPM2SETUP" --help
 "$SD_TPM2SETUP" --version
 "$SD_TPM2SETUP" --tpm2-device=list
diff --git a/test/units/TEST-71-HOSTNAME.sh b/test/units/TEST-71-HOSTNAME.sh
index 8ec3bd6cfb..ffb110be68 100755
--- a/test/units/TEST-71-HOSTNAME.sh
+++ b/test/units/TEST-71-HOSTNAME.sh
@@ -166,6 +166,10 @@ testcase_hardware_serial() {
 testcase_nss-myhostname() {
     local database host i
 
+    if ! check_nss_module myhostname; then
+        return 0
+    fi
+
     HOSTNAME="$(hostnamectl hostname)"
 
     # Set up a dummy network for _gateway and _outbound labels
@@ -316,7 +320,6 @@ EOF
     assert_in "CHASSIS=watch" "$(cat /run/alternate-path/mymachine-info)"
 }
 
-
 run_testcases
 
 touch /testok
diff --git a/test/units/TEST-74-AUX-UTILS.capsule.sh b/test/units/TEST-74-AUX-UTILS.capsule.sh
index 06f6a1ca6e..c2c3073ea8 100755
--- a/test/units/TEST-74-AUX-UTILS.capsule.sh
+++ b/test/units/TEST-74-AUX-UTILS.capsule.sh
@@ -4,6 +4,13 @@
 set -eux
 set -o pipefail
 
+# shellcheck source=test/units/util.sh
+. "$(dirname "$0")"/util.sh
+
+if ! check_nss_module systemd; then
+    exit 0
+fi
+
 at_exit() {
     set +e
     systemctl --no-block stop capsule@foobar.service
diff --git a/test/units/TEST-75-RESOLVED.sh b/test/units/TEST-75-RESOLVED.sh
index a9504f5d1c..5ec588309b 100755
--- a/test/units/TEST-75-RESOLVED.sh
+++ b/test/units/TEST-75-RESOLVED.sh
@@ -408,6 +408,11 @@ manual_testcase_02_mdns_llmnr() {
 
 testcase_03_23951() {
     : "--- nss-resolve/nss-myhostname tests"
+
+    if ! check_nss_module resolve; then
+        return 0
+    fi
+
     # Sanity check
     TIMESTAMP=$(date '+%F %T')
     # Issue: https://github.com/systemd/systemd/issues/23951
@@ -426,6 +431,10 @@ testcase_03_23951() {
 }
 
 testcase_04_18812() {
+    if ! check_nss_module resolve; then
+        return 0
+    fi
+
     # Issue: https://github.com/systemd/systemd/issues/18812
     # PR: https://github.com/systemd/systemd/pull/18896
     # Follow-up issue: https://github.com/systemd/systemd/issues/23152
@@ -446,6 +455,10 @@ testcase_04_18812() {
 }
 
 testcase_05_25088() {
+    if ! check_nss_module resolve; then
+        return 0
+    fi
+
     # Issue: https://github.com/systemd/systemd/issues/25088
     run getent -s resolve hosts 127.128.0.5
     grep -qEx '127\.128\.0\.5\s+localhost5(\s+localhost5?\.localdomain[45]?){4}' "$RUN_OUT"
@@ -951,7 +964,7 @@ testcase_10_resolvectl_json() {
 # Test serve stale feature and NFTSet= if nftables is installed
 testcase_11_nft() {
     if ! command -v nft >/dev/null; then
-        echo "nftables is not installed. Skipped serve stale feature and NFTSet= tests."
+        echo "nftables is not installed. Skipped serve stale feature tests."
         return 0
     fi
 
@@ -979,6 +992,12 @@ testcase_11_nft() {
     grep -qE "no servers could be reached" "$RUN_OUT"
     nft flush ruleset
 
+    . /etc/os-release
+    if [[ "${ID_LIKE:-}" == alpine ]]; then
+        # FIXME: For some reasons, the following tests will fail on alpine/postmarketos.
+        return 0
+    fi
+
     ### Test TIMEOUT with serve stale feature ###
 
     mkdir -p /run/systemd/resolved.conf.d
@@ -1013,62 +1032,6 @@ testcase_11_nft() {
     grep -qE "NXDOMAIN" "$RUN_OUT"
 
     nft flush ruleset
-
-    ### NFTSet= test
-    nft add table inet sd_test
-    nft add set inet sd_test c '{ type cgroupsv2; }'
-    nft add set inet sd_test u '{ typeof meta skuid; }'
-    nft add set inet sd_test g '{ typeof meta skgid; }'
-
-    # service
-    systemd-run --unit test-nft.service --service-type=exec -p DynamicUser=yes \
-                -p 'NFTSet=cgroup:inet:sd_test:c user:inet:sd_test:u group:inet:sd_test:g' sleep 10000
-    run nft list set inet sd_test c
-    grep -qF "test-nft.service" "$RUN_OUT"
-    uid=$(getent passwd test-nft | cut -d':' -f3)
-    run nft list set inet sd_test u
-    grep -qF "$uid" "$RUN_OUT"
-    gid=$(getent passwd test-nft | cut -d':' -f4)
-    run nft list set inet sd_test g
-    grep -qF "$gid" "$RUN_OUT"
-    systemctl stop test-nft.service
-
-    # scope
-    run systemd-run --scope -u test-nft.scope -p 'NFTSet=cgroup:inet:sd_test:c' nft list set inet sd_test c
-    grep -qF "test-nft.scope" "$RUN_OUT"
-
-    mkdir -p /run/systemd/system
-    # socket
-    {
-        echo "[Socket]"
-        echo "ListenStream=12345"
-        echo "BindToDevice=lo"
-        echo "NFTSet=cgroup:inet:sd_test:c"
-    } >/run/systemd/system/test-nft.socket
-    {
-        echo "[Service]"
-        echo "ExecStart=sleep 10000"
-    } >/run/systemd/system/test-nft.service
-    systemctl daemon-reload
-    systemctl start test-nft.socket
-    systemctl status test-nft.socket
-    run nft list set inet sd_test c
-    grep -qF "test-nft.socket" "$RUN_OUT"
-    systemctl stop test-nft.socket
-    rm -f /run/systemd/system/test-nft.{socket,service}
-
-    # slice
-    mkdir /run/systemd/system/system.slice.d
-    {
-        echo "[Slice]"
-        echo "NFTSet=cgroup:inet:sd_test:c"
-    } >/run/systemd/system/system.slice.d/00-test-nft.conf
-    systemctl daemon-reload
-    run nft list set inet sd_test c
-    grep -qF "system.slice" "$RUN_OUT"
-    rm -rf /run/systemd/system/system.slice.d
-
-    nft flush ruleset
 }
 
 # Test resolvectl show-server-state
diff --git a/test/units/TEST-82-SOFTREBOOT.sh b/test/units/TEST-82-SOFTREBOOT.sh
index 274e54a117..378ac2a2a2 100755
--- a/test/units/TEST-82-SOFTREBOOT.sh
+++ b/test/units/TEST-82-SOFTREBOOT.sh
@@ -90,12 +90,16 @@ if [ -f /run/TEST-82-SOFTREBOOT.touch3 ]; then
 
     # Check that the surviving services are still around
     test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-survive.service)" = "active"
-    test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-survive-argv.service)" = "active"
+    if [[ ! -L $(command -v sleep) ]]; then
+        test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-survive-argv.service)" = "active"
+    fi
     test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-nosurvive-sigterm.service)" != "active"
     test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-nosurvive.service)" != "active"
 
     [[ ! -e /run/credentials/TEST-82-SOFTREBOOT-nosurvive.service ]]
-    assert_eq "$(cat /run/credentials/TEST-82-SOFTREBOOT-survive-argv.service/preserve)" "yay"
+    if [[ ! -L $(command -v sleep) ]]; then
+        assert_eq "$(cat /run/credentials/TEST-82-SOFTREBOOT-survive-argv.service/preserve)" "yay"
+    fi
 
     # There may be huge amount of pending messages in sockets. Processing them may cause journal rotation and
     # removal of old archived journal files. If a journal file is removed during journalctl reading it,
@@ -130,7 +134,9 @@ elif [ -f /run/TEST-82-SOFTREBOOT.touch2 ]; then
 
     # Check that the surviving services are still around
     test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-survive.service)" = "active"
-    test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-survive-argv.service)" = "active"
+    if [[ ! -L $(command -v sleep) ]]; then
+        test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-survive-argv.service)" = "active"
+    fi
     test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-nosurvive-sigterm.service)" != "active"
     test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-nosurvive.service)" != "active"
 
@@ -186,7 +192,9 @@ elif [ -f /run/TEST-82-SOFTREBOOT.touch ]; then
 
     # Check that the surviving services are still around
     test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-survive.service)" = "active"
-    test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-survive-argv.service)" = "active"
+    if [[ ! -L $(command -v sleep) ]]; then
+        test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-survive-argv.service)" = "active"
+    fi
     test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-nosurvive-sigterm.service)" != "active"
     test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-nosurvive.service)" != "active"
 
@@ -272,15 +280,19 @@ EOF
     # '@', and the second will use SurviveFinalKillSignal=yes. Both should survive.
     # By writing to stdout, which is connected to the journal, we also ensure logging doesn't break across
     # soft reboots due to journald being temporarily stopped.
-    systemd-run --service-type=notify --unit=TEST-82-SOFTREBOOT-survive-argv.service \
-        --property SurviveFinalKillSignal=no \
-        --property IgnoreOnIsolate=yes \
-        --property DefaultDependencies=no \
-        --property After=basic.target \
-        --property "Conflicts=reboot.target kexec.target poweroff.target halt.target emergency.target rescue.target" \
-        --property "Before=reboot.target kexec.target poweroff.target halt.target emergency.target rescue.target" \
-        --property SetCredential=preserve:yay \
-         "$survive_argv"
+    # Note, when coreutils is built with --enable-single-binary=symlinks, unfortunately we cannot freely rename
+    # sleep command, hence we cannot test the feature.
+    if [[ ! -L $(command -v sleep) ]]; then
+        systemd-run --service-type=notify --unit=TEST-82-SOFTREBOOT-survive-argv.service \
+            --property SurviveFinalKillSignal=no \
+            --property IgnoreOnIsolate=yes \
+            --property DefaultDependencies=no \
+            --property After=basic.target \
+            --property "Conflicts=reboot.target kexec.target poweroff.target halt.target emergency.target rescue.target" \
+            --property "Before=reboot.target kexec.target poweroff.target halt.target emergency.target rescue.target" \
+            --property SetCredential=preserve:yay \
+            "$survive_argv"
+    fi
     # shellcheck disable=SC2016
     systemd-run --service-type=exec --unit=TEST-82-SOFTREBOOT-survive.service \
         --property TemporaryFileSystem="/run /tmp /var" \
diff --git a/test/units/TEST-87-AUX-UTILS-VM.coredump.sh b/test/units/TEST-87-AUX-UTILS-VM.coredump.sh
index 19f0fa280e..1b37197bde 100755
--- a/test/units/TEST-87-AUX-UTILS-VM.coredump.sh
+++ b/test/units/TEST-87-AUX-UTILS-VM.coredump.sh
@@ -4,7 +4,12 @@ set -eux
 set -o pipefail
 
 # shellcheck source=test/units/util.sh
- . "$(dirname "$0")"/util.sh
+. "$(dirname "$0")"/util.sh
+
+if [[ -L $(command -v sleep) ]]; then
+    # coreutils is built with --enable-single-binary=symlinks, and we cannot rename it.
+    exit 0
+fi
 
 # Make sure the binary name fits into 15 characters
 CORE_TEST_BIN="/tmp/test-dump"
diff --git a/test/units/TEST-89-RESOLVED-MDNS.sh b/test/units/TEST-89-RESOLVED-MDNS.sh
index a7062b813a..ae18cd49e8 100755
--- a/test/units/TEST-89-RESOLVED-MDNS.sh
+++ b/test/units/TEST-89-RESOLVED-MDNS.sh
@@ -6,6 +6,12 @@ set -o pipefail
 # shellcheck source=test/units/test-control.sh
 . "$(dirname "$0")"/test-control.sh
 
+. /etc/os-release
+if [[ "${ID_LIKE:-}" == alpine ]]; then
+    # FIXME: For some reasons (maybe this test requires nss module??), the test fails on alpine/postmarketos.
+    exit 77
+fi
+
 SERVICE_TYPE_COUNT=10
 SERVICE_COUNT=20
 CONTAINER_ZONE="test-$RANDOM"
diff --git a/test/units/autorelabel.service b/test/units/autorelabel.service
index f0f4db397d..1d94cb0a1c 100644
--- a/test/units/autorelabel.service
+++ b/test/units/autorelabel.service
@@ -22,7 +22,7 @@ ConditionPathExists=|/.autorelabel
 SuccessAction=reboot
 
 [Service]
-ExecStart=sh -xec 'echo 0 >/sys/fs/selinux/enforce; fixfiles -f -F relabel; rm /.autorelabel;'
+ExecStart=bash -xec 'echo 0 >/sys/fs/selinux/enforce; fixfiles -f -F relabel; rm /.autorelabel;'
 Type=oneshot
 TimeoutSec=infinity
 
diff --git a/test/units/util.sh b/test/units/util.sh
index d07364922f..c62f8d9574 100755
--- a/test/units/util.sh
+++ b/test/units/util.sh
@@ -453,3 +453,42 @@ generate_locale() {
         locale-gen "$locale"
     fi
 }
+
+built_with_musl() (
+    set +ex
+    ! systemd-analyze --quiet condition 'ConditionVersion=glibc $= ?*'
+)
+
+check_nss_module() (
+    set +e
+
+    local name="${1:?}"
+    local have=
+    local i
+
+    if [[ ! -e /etc/nsswitch.conf ]]; then
+        : "/etc/nsswitch.conf not found."
+        return 1
+    fi
+
+    if ! find /usr/lib* -name "libnss_${name}.so.*" 2>/dev/null | grep . >/dev/null; then
+        : "NSS module $name not found."
+        return 1
+    fi
+
+    if [[ "$name" == systemd ]]; then
+        for i in passwd group shadow; do
+            if ! grep -qE "^$i:.*[[:space:]]*systemd" /etc/nsswitch.conf; then
+                : "systemd NSS module is not enabled for $i database."
+                return 1
+            fi
+        done
+    else
+        if ! grep -qE "^hosts:.*[[:space:]]*$name" /etc/nsswitch.conf; then
+            : "$name NSS module is not enabled for hosts database."
+            return 1
+        fi
+    fi
+
+    return 0
+)