From a5d0e0ebb2890b16a2a2eba3f166280258423161 Mon Sep 17 00:00:00 2001
From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Wed, 26 Nov 2025 17:37:19 +0900
Subject: [PATCH 01/15] ci: pass --no-stdsplit to meson test

Hopefully, we will get more informative logs on failure.
---
 .github/workflows/unit-tests-musl.sh | 2 +-
 .github/workflows/unit-tests.sh      | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/unit-tests-musl.sh b/.github/workflows/unit-tests-musl.sh
index 6ba448adaf..ab7cdf0a70 100755
--- a/.github/workflows/unit-tests-musl.sh
+++ b/.github/workflows/unit-tests-musl.sh
@@ -47,7 +47,7 @@ for phase in "${PHASES[@]}"; do
             # correctly detect the environment.
             env \
                 SYSTEMD_IN_CHROOT=yes \
-                meson test -C build --print-errorlogs
+                meson test -C build --print-errorlogs --no-stdsplit
             ;;
         CLEANUP)
             info "Cleanup phase"
diff --git a/.github/workflows/unit-tests.sh b/.github/workflows/unit-tests.sh
index ceecaf3fe0..c119a86011 100755
--- a/.github/workflows/unit-tests.sh
+++ b/.github/workflows/unit-tests.sh
@@ -109,7 +109,7 @@ for phase in "${PHASES[@]}"; do
             run_meson -Dnobody-group=nogroup --werror -Dtests=unsafe -Dslow-tests=true -Dfuzz-tests=true "${MESON_ARGS[@]}" build
             ninja -C build -v
             # Ensure setting a timezone (like the reproducible build tests do) does not break time/date unit tests
-            TZ=GMT+12 meson test "${MESON_TEST_ARGS[@]}" -C build --print-errorlogs
+            TZ=GMT+12 meson test "${MESON_TEST_ARGS[@]}" -C build --print-errorlogs --no-stdsplit
             ;;
         RUN_ASAN_UBSAN|RUN_GCC_ASAN_UBSAN|RUN_CLANG_ASAN_UBSAN|RUN_CLANG_ASAN_UBSAN_NO_DEPS)
             # TODO: drop after we switch to ubuntu 26.04
@@ -151,7 +151,7 @@ for phase in "${PHASES[@]}"; do
             # during debugging, wonderful), so let's at least keep a workaround
             # here to make the builds stable for the time being.
             (set +x; while :; do echo -ne "\n[WATCHDOG] $(date)\n"; sleep 30; done) &
-            meson test --timeout-multiplier=3 -C build --print-errorlogs
+            meson test --timeout-multiplier=3 -C build --print-errorlogs --no-stdsplit
             ;;
         CLEANUP)
             info "Cleanup phase"

From b49a4696c44a68cf7059a8e6d49b21d0fc509702 Mon Sep 17 00:00:00 2001
From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Mon, 24 Nov 2025 13:37:04 +0900
Subject: [PATCH 02/15] test: always use bash

If sh is not bash, some builtin command behave slightly differently.
E.g. if sh is provided by busybox, its builtin test command does not check if
the path is a mount point or not, and 'test -w' only checks the access mode of
the inode. So, even if a readonly filesystem is mounted on a directory,
the test command may succeed.

To avoid such confusion, let's unconditionally use bash.
---
 .../forever-print-hola.service                |  2 +-
 .../defer-reactivation.service                |  2 +-
 .../TEST-07-PID1.units/issue27953.service     |  2 +-
 .../TEST-07-PID1/meson.build                  |  2 +-
 .../TEST-23-UNIT-FILE-namespaced.service      |  2 +-
 .../TEST-23-UNIT-FILE-non-namespaced.service  |  2 +-
 .../TEST-23-UNIT-FILE-retry-fail.service      |  2 +-
 .../test-honor-first-shutdown.service         |  2 +-
 .../TEST-62-RESTRICT-IFACES-1.service         |  6 +--
 .../TEST-62-RESTRICT-IFACES-2.service         |  6 +--
 .../TEST-62-RESTRICT-IFACES-3.service         |  6 +--
 .../TEST-62-RESTRICT-IFACES-4.service         |  6 +--
 .../TEST-62-RESTRICT-IFACES-5.service         |  6 +--
 .../TEST-62-RESTRICT-IFACES-6.service         |  6 +--
 .../TEST-63-PATH.units/test63-glob.service    |  4 +-
 .../TEST-63-PATH.units/test63.service         |  4 +-
 .../exec-ambientcapabilities-dynuser.service  |  2 +-
 ...mbientcapabilities-merge-nfsnobody.service |  2 +-
 ...c-ambientcapabilities-merge-nobody.service |  2 +-
 .../exec-ambientcapabilities-merge.service    |  2 +-
 ...exec-ambientcapabilities-nfsnobody.service |  2 +-
 .../exec-ambientcapabilities-nobody.service   |  2 +-
 .../exec-ambientcapabilities.service          |  2 +-
 test/test-execute/exec-basic.service          |  2 +-
 test/test-execute/exec-bindpaths.service      |  2 +-
 .../exec-capabilityboundingset-invert.service |  2 +-
 .../exec-capabilityboundingset-merge.service  |  2 +-
 .../exec-capabilityboundingset-reset.service  |  2 +-
 .../exec-capabilityboundingset-simple.service |  2 +-
 .../exec-condition-failed.service             |  4 +-
 test/test-execute/exec-condition-skip.service |  8 ++--
 test/test-execute/exec-cpuaffinity1.service   |  2 +-
 test/test-execute/exec-cpuaffinity2.service   |  2 +-
 test/test-execute/exec-cpuaffinity3.service   |  2 +-
 .../exec-credentials-dir-specifier.service    |  8 ++--
 .../exec-dynamicuser-fixeduser-adm.service    |  4 +-
 .../exec-dynamicuser-fixeduser-games.service  |  4 +-
 ...r-fixeduser-one-supplementarygroup.service |  4 +-
 .../exec-dynamicuser-fixeduser.service        |  4 +-
 ...exec-dynamicuser-runtimedirectory1.service |  6 +--
 ...exec-dynamicuser-runtimedirectory2.service |  8 ++--
 ...exec-dynamicuser-runtimedirectory3.service |  8 ++--
 ...dynamicuser-statedir-migrate-step1.service |  2 +-
 ...dynamicuser-statedir-migrate-step2.service |  2 +-
 .../exec-dynamicuser-statedir.service         |  2 +-
 ...ec-dynamicuser-supplementarygroups.service |  4 +-
 .../exec-environment-empty.service            |  2 +-
 .../exec-environment-multiple.service         |  2 +-
 .../exec-environment-no-substitute.service    |  4 +-
 test/test-execute/exec-environment.service    |  2 +-
 .../test-execute/exec-environmentfile.service |  2 +-
 ...xecsearchpath-environment-path-set.service |  2 +-
 .../exec-execsearchpath-environment.service   |  2 +-
 ...execsearchpath-environmentfile-set.service |  2 +-
 ...xec-execsearchpath-environmentfile.service |  2 +-
 ...execsearchpath-passenvironment-set.service |  2 +-
 ...xec-execsearchpath-passenvironment.service |  2 +-
 ...exec-execsearchpath-unit-specifier.service |  2 +-
 .../test-execute/exec-group-nfsnobody.service |  2 +-
 test/test-execute/exec-group-nobody.service   |  2 +-
 test/test-execute/exec-group-nogroup.service  |  2 +-
 test/test-execute/exec-group.service          |  2 +-
 .../exec-ignoresigpipe-no.service             |  2 +-
 .../exec-ignoresigpipe-yes.service            |  2 +-
 ...naccessiblepaths-mount-propagation.service |  2 +-
 .../exec-inaccessiblepaths-sys.service        |  2 +-
 ...exec-ioschedulingclass-best-effort.service |  2 +-
 .../exec-ioschedulingclass-idle.service       |  2 +-
 .../exec-ioschedulingclass-none.service       |  2 +-
 .../exec-ioschedulingclass-realtime.service   |  2 +-
 .../test-execute/exec-load-credential.service |  8 ++--
 ...worknamespacepath-privatemounts-no.service | 12 ++---
 ...orknamespacepath-privatemounts-yes.service | 12 ++---
 .../exec-noexecpaths-simple.service           |  4 +-
 .../exec-oomscoreadjust-negative.service      |  2 +-
 .../exec-oomscoreadjust-positive.service      |  2 +-
 .../exec-passenvironment-absent.service       |  2 +-
 .../exec-passenvironment-empty.service        |  2 +-
 .../exec-passenvironment-repeated.service     |  2 +-
 .../test-execute/exec-passenvironment.service |  2 +-
 .../exec-personality-aarch64.service          |  2 +-
 .../exec-personality-loongarch64.service      |  2 +-
 .../exec-personality-ppc64.service            |  2 +-
 .../exec-personality-ppc64le.service          |  2 +-
 .../exec-personality-s390.service             |  2 +-
 .../exec-personality-s390x.service            |  2 +-
 .../exec-personality-x86-64.service           |  2 +-
 .../test-execute/exec-personality-x86.service |  2 +-
 .../exec-privatedevices-bind.service          |  4 +-
 ...-privatedevices-disabled-by-prefix.service |  4 +-
 ...privatedevices-no-capability-mknod.service |  2 +-
 ...atedevices-no-capability-sys-rawio.service |  2 +-
 .../exec-privatedevices-no.service            |  2 +-
 ...rivatedevices-yes-capability-mknod.service |  2 +-
 ...tedevices-yes-capability-sys-rawio.service |  2 +-
 ...exec-privatedevices-yes-with-group.service |  6 +--
 .../exec-privatedevices-yes.service           |  2 +-
 ...rivatenetwork-yes-privatemounts-no.service |  6 +--
 ...ivatenetwork-yes-privatemounts-yes.service |  6 +--
 ...exec-privatetmp-disabled-by-prefix.service |  4 +-
 ...nnected-after-and-requires-for-var.service |  4 +-
 ...sconnected-after-and-wants-for-var.service |  4 +-
 ...isconnected-defaultdependencies-no.service |  6 +--
 ...ected-nodefaultdeps-nor-sandboxing.service |  2 +-
 ...sconnected-requires-mounts-for-var.service |  4 +-
 ...-disconnected-wants-mounts-for-var.service |  4 +-
 .../exec-privatetmp-disconnected.service      |  4 +-
 test/test-execute/exec-privatetmp-no.service  |  2 +-
 test/test-execute/exec-privatetmp-yes.service |  2 +-
 ...home-tmpfs-vs-protectsystem-strict.service |  2 +-
 ...-protectkernellogs-no-capabilities.service |  2 +-
 ...protectkernellogs-yes-capabilities.service |  2 +-
 ...otectkernelmodules-no-capabilities.service |  2 +-
 ...tectkernelmodules-yes-capabilities.service |  2 +-
 ...ernelmodules-yes-mount-propagation.service |  2 +-
 ...ec-readonlypaths-mount-propagation.service |  2 +-
 .../exec-readonlypaths-simple.service         |  6 +--
 .../exec-readonlypaths-with-bindpaths.service |  2 +-
 test/test-execute/exec-readonlypaths.service  |  4 +-
 ...c-readwritepaths-mount-propagation.service |  2 +-
 .../exec-restrictnamespaces-merge-and.service |  2 +-
 .../exec-restrictnamespaces-merge-or.service  |  2 +-
 .../exec-runtimedirectory-mode.service        |  4 +-
 ...c-runtimedirectory-owner-nfsnobody.service |  2 +-
 ...exec-runtimedirectory-owner-nobody.service |  2 +-
 ...xec-runtimedirectory-owner-nogroup.service |  2 +-
 .../exec-runtimedirectory-owner.service       |  2 +-
 .../exec-runtimedirectory.service             |  6 +--
 test/test-execute/exec-set-credential.service |  4 +-
 test/test-execute/exec-specifier-user.service | 10 ++--
 test/test-execute/exec-specifier.service      | 16 +++----
 test/test-execute/exec-specifier@.service     | 16 +++----
 .../exec-standardinput-data.service           |  2 +-
 .../exec-standardoutput-append.service        |  4 +-
 .../exec-standardoutput-file.service          |  4 +-
 .../exec-standardoutput-truncate.service      |  6 +--
 ...multiple-groups-default-group-user.service |  8 ++--
 ...tarygroups-multiple-groups-withgid.service |  6 +--
 ...tarygroups-multiple-groups-withuid.service |  4 +-
 ...plementarygroups-single-group-user.service |  4 +-
 ...c-supplementarygroups-single-group.service |  4 +-
 .../exec-supplementarygroups.service          |  4 +-
 .../exec-systemcallfilter-failing.service     |  2 +-
 .../exec-systemcallfilter-failing2.service    |  2 +-
 .../exec-systemcallfilter-failing3.service    |  2 +-
 ...llfilter-nonewprivileges-bounding1.service |  2 +-
 ...llfilter-nonewprivileges-bounding2.service |  2 +-
 ...ilter-nonewprivileges-protectclock.service |  2 +-
 ...c-systemcallfilter-nonewprivileges.service |  2 +-
 .../exec-systemcallfilter-not-failing.service |  2 +-
 ...exec-systemcallfilter-not-failing2.service |  2 +-
 ...exec-systemcallfilter-not-failing3.service |  2 +-
 ...emcallfilter-system-user-nfsnobody.service |  2 +-
 ...ystemcallfilter-system-user-nobody.service |  2 +-
 .../exec-systemcallfilter-system-user.service |  2 +-
 .../exec-temporaryfilesystem-options.service  |  8 ++--
 .../exec-temporaryfilesystem-ro.service       | 18 +++----
 .../exec-temporaryfilesystem-rw.service       |  6 +--
 .../exec-temporaryfilesystem-usr.service      |  6 +--
 test/test-execute/exec-umask-0177.service     |  2 +-
 test/test-execute/exec-umask-default.service  |  2 +-
 .../exec-unsetenvironment.service             |  2 +-
 test/test-execute/exec-user-nfsnobody.service |  2 +-
 test/test-execute/exec-user-nobody.service    |  2 +-
 test/test-execute/exec-user.service           |  2 +-
 ...exec-workingdirectory-trailing-dot.service |  2 +-
 .../exec-workingdirectory.service             |  2 +-
 test/test-udev.py                             |  8 ++--
 test/units/TEST-03-JOBS.sh                    |  4 +-
 test/units/TEST-04-JOURNAL.journal.sh         |  4 +-
 .../units/TEST-07-PID1.delegate-namespaces.sh |  4 +-
 test/units/TEST-07-PID1.exec-context.sh       |  2 +-
 test/units/TEST-07-PID1.exec-timestamps.sh    |  2 +-
 test/units/TEST-07-PID1.issue-1981.sh         |  6 +--
 test/units/TEST-07-PID1.issue-27953.sh        |  2 +-
 test/units/TEST-07-PID1.issue-30412.sh        |  2 +-
 test/units/TEST-07-PID1.issue-3171.sh         |  2 +-
 .../TEST-07-PID1.protect-control-groups.sh    |  6 +--
 .../TEST-07-PID1.transient-unit-container.sh  |  2 +-
 test/units/TEST-13-NSPAWN.machined.sh         |  2 +-
 test/units/TEST-13-NSPAWN.nspawn-oci.sh       | 12 ++---
 test/units/TEST-13-NSPAWN.nss-mymachines.sh   |  2 +-
 test/units/TEST-16-EXTEND-TIMEOUT.sh          |  8 ++--
 test/units/TEST-23-UNIT-FILE.ExecStopPost.sh  |  2 +-
 .../units/TEST-23-UNIT-FILE.StandardOutput.sh |  8 ++--
 test/units/TEST-23-UNIT-FILE.statedir.sh      |  4 +-
 test/units/TEST-34-DYNAMICUSERMIGRATE.sh      |  8 ++--
 test/units/TEST-43-PRIVATEUSER-UNPRIV.sh      |  8 ++--
 test/units/TEST-46-HOMED.sh                   | 48 +++++++++----------
 test/units/TEST-50-DISSECT.dissect.sh         |  2 +-
 test/units/TEST-50-DISSECT.mountfsd.sh        |  6 +--
 test/units/TEST-65-ANALYZE.sh                 |  2 +-
 test/units/autorelabel.service                |  2 +-
 193 files changed, 364 insertions(+), 364 deletions(-)

diff --git a/test/integration-tests/TEST-04-JOURNAL/TEST-04-JOURNAL.units/forever-print-hola.service b/test/integration-tests/TEST-04-JOURNAL/TEST-04-JOURNAL.units/forever-print-hola.service
index 9273d6d3fb..6858ceb29b 100644
--- a/test/integration-tests/TEST-04-JOURNAL/TEST-04-JOURNAL.units/forever-print-hola.service
+++ b/test/integration-tests/TEST-04-JOURNAL/TEST-04-JOURNAL.units/forever-print-hola.service
@@ -4,4 +4,4 @@ Description=ForeverPrintHola service
 
 [Service]
 Type=exec
-ExecStart=sh -x -c 'while :; do printf "Hola\n" || touch /tmp/i-lose-my-logs; sleep 1; done'
+ExecStart=bash -x -c 'while :; do printf "Hola\n" || touch /tmp/i-lose-my-logs; sleep 1; done'
diff --git a/test/integration-tests/TEST-07-PID1/TEST-07-PID1.units/defer-reactivation.service b/test/integration-tests/TEST-07-PID1/TEST-07-PID1.units/defer-reactivation.service
index 9c7332d6c9..de30aff603 100644
--- a/test/integration-tests/TEST-07-PID1/TEST-07-PID1.units/defer-reactivation.service
+++ b/test/integration-tests/TEST-07-PID1/TEST-07-PID1.units/defer-reactivation.service
@@ -3,4 +3,4 @@ Description=Test for DeferReactivation=yes (service)
 
 [Service]
 Type=simple
-ExecStart=sh -c 'date +%%s >>/tmp/defer-reactivation.log; sleep 5'
+ExecStart=bash -c 'date +%%s >>/tmp/defer-reactivation.log; sleep 5'
diff --git a/test/integration-tests/TEST-07-PID1/TEST-07-PID1.units/issue27953.service b/test/integration-tests/TEST-07-PID1/TEST-07-PID1.units/issue27953.service
index f441067822..ca75d37add 100644
--- a/test/integration-tests/TEST-07-PID1/TEST-07-PID1.units/issue27953.service
+++ b/test/integration-tests/TEST-07-PID1/TEST-07-PID1.units/issue27953.service
@@ -4,4 +4,4 @@ Description=This unit should not remain active once the shell process exits
 
 [Service]
 Type=oneshot
-ExecStart=sh -c 'sleep infinity & exit 0'
+ExecStart=bash -c 'sleep infinity & exit 0'
diff --git a/test/integration-tests/TEST-07-PID1/meson.build b/test/integration-tests/TEST-07-PID1/meson.build
index 678fc5f0ec..39077437a0 100644
--- a/test/integration-tests/TEST-07-PID1/meson.build
+++ b/test/integration-tests/TEST-07-PID1/meson.build
@@ -7,7 +7,7 @@ integration_tests += [
                         'service' : integration_test_template['configuration']['service'] + {
                                 'NotifyAccess' : 'all',
                                 # Issue: https://github.com/systemd/systemd/issues/2691
-                                'ExecStop' : 'sh -c \'kill -SEGV $$$$\'',
+                                'ExecStop' : 'bash -c \'kill -SEGV $$$$\'',
                                 'RemainAfterExit' : 'yes',
                                 'TimeoutStopSec' : '270s',
                         },
diff --git a/test/integration-tests/TEST-23-UNIT-FILE/TEST-23-UNIT-FILE.units/TEST-23-UNIT-FILE-namespaced.service b/test/integration-tests/TEST-23-UNIT-FILE/TEST-23-UNIT-FILE.units/TEST-23-UNIT-FILE-namespaced.service
index 82eb74c0bd..3823614504 100644
--- a/test/integration-tests/TEST-23-UNIT-FILE/TEST-23-UNIT-FILE.units/TEST-23-UNIT-FILE-namespaced.service
+++ b/test/integration-tests/TEST-23-UNIT-FILE/TEST-23-UNIT-FILE.units/TEST-23-UNIT-FILE-namespaced.service
@@ -10,4 +10,4 @@ PrivateTmp=yes
 BindPaths=/run/TEST-23-UNIT-FILE-marker-fixed:/tmp/testfile-marker-fixed
 InaccessiblePaths=/run/inaccessible
 ExecStartPre=grep -q -F MARKER_FIXED /tmp/testfile-marker-fixed
-ExecStart=sh -c 'systemd-notify --ready; until grep -q -F MARKER_RUNTIME /tmp/testfile-marker-runtime; do sleep 0.1; done; test ! -f /run/inaccessible/testfile-marker-fixed'
+ExecStart=bash -c 'systemd-notify --ready; until grep -q -F MARKER_RUNTIME /tmp/testfile-marker-runtime; do sleep 0.1; done; test ! -f /run/inaccessible/testfile-marker-fixed'
diff --git a/test/integration-tests/TEST-23-UNIT-FILE/TEST-23-UNIT-FILE.units/TEST-23-UNIT-FILE-non-namespaced.service b/test/integration-tests/TEST-23-UNIT-FILE/TEST-23-UNIT-FILE.units/TEST-23-UNIT-FILE-non-namespaced.service
index 699b6080d3..bb94a4629e 100644
--- a/test/integration-tests/TEST-23-UNIT-FILE/TEST-23-UNIT-FILE.units/TEST-23-UNIT-FILE-non-namespaced.service
+++ b/test/integration-tests/TEST-23-UNIT-FILE/TEST-23-UNIT-FILE.units/TEST-23-UNIT-FILE-non-namespaced.service
@@ -3,4 +3,4 @@
 RuntimeMaxSec=5
 Type=notify
 RemainAfterExit=yes
-ExecStart=sh -c 'systemd-notify --ready; until grep -q -F MARKER_RUNTIME /tmp/testfile-marker-runtime; do sleep 0.1; done; exit 0'
+ExecStart=bash -c 'systemd-notify --ready; until grep -q -F MARKER_RUNTIME /tmp/testfile-marker-runtime; do sleep 0.1; done; exit 0'
diff --git a/test/integration-tests/TEST-23-UNIT-FILE/TEST-23-UNIT-FILE.units/TEST-23-UNIT-FILE-retry-fail.service b/test/integration-tests/TEST-23-UNIT-FILE/TEST-23-UNIT-FILE.units/TEST-23-UNIT-FILE-retry-fail.service
index 319757a44d..bf68ca2dda 100644
--- a/test/integration-tests/TEST-23-UNIT-FILE/TEST-23-UNIT-FILE.units/TEST-23-UNIT-FILE-retry-fail.service
+++ b/test/integration-tests/TEST-23-UNIT-FILE/TEST-23-UNIT-FILE.units/TEST-23-UNIT-FILE-retry-fail.service
@@ -5,5 +5,5 @@ Description=Failed Dependency Unit
 [Service]
 Type=oneshot
 RemainAfterExit=yes
-ExecStart=sh -c "if [ -f /tmp/TEST-23-UNIT-FILE-retry-fail ]; then exit 0; else exit 1; fi"
+ExecStart=bash -c "if [ -f /tmp/TEST-23-UNIT-FILE-retry-fail ]; then exit 0; else exit 1; fi"
 Restart=no
diff --git a/test/integration-tests/TEST-52-HONORFIRSTSHUTDOWN/TEST-52-HONORFIRSTSHUTDOWN.units/test-honor-first-shutdown.service b/test/integration-tests/TEST-52-HONORFIRSTSHUTDOWN/TEST-52-HONORFIRSTSHUTDOWN.units/test-honor-first-shutdown.service
index bbeac3a74e..687d749156 100644
--- a/test/integration-tests/TEST-52-HONORFIRSTSHUTDOWN/TEST-52-HONORFIRSTSHUTDOWN.units/test-honor-first-shutdown.service
+++ b/test/integration-tests/TEST-52-HONORFIRSTSHUTDOWN/TEST-52-HONORFIRSTSHUTDOWN.units/test-honor-first-shutdown.service
@@ -5,7 +5,7 @@ After=multi-user.target
 
 [Service]
 ExecStart=/usr/lib/systemd/tests/testdata/TEST-52-HONORFIRSTSHUTDOWN.units/%N.sh
-ExecStop=sh -c 'kill -KILL $MAINPID'
+ExecStop=bash -c 'kill -KILL $MAINPID'
 FailureAction=reboot
 
 [Install]
diff --git a/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-1.service b/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-1.service
index 16695c18a2..dc0bea2c50 100644
--- a/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-1.service
+++ b/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-1.service
@@ -2,8 +2,8 @@
 [Unit]
 Description=TEST-62-RESTRICT-IFACES-all-pings-work
 [Service]
-ExecStart=sh -c 'ping -c 1 -W 0.2 192.168.113.1'
-ExecStart=sh -c 'ping -c 1 -W 0.2 192.168.113.5'
-ExecStart=sh -c 'ping -c 1 -W 0.2 192.168.113.9'
+ExecStart=bash -c 'ping -c 1 -W 0.2 192.168.113.1'
+ExecStart=bash -c 'ping -c 1 -W 0.2 192.168.113.5'
+ExecStart=bash -c 'ping -c 1 -W 0.2 192.168.113.9'
 RestrictNetworkInterfaces=
 Type=oneshot
diff --git a/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-2.service b/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-2.service
index bce7e8e6cb..7bbb2149fd 100644
--- a/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-2.service
+++ b/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-2.service
@@ -2,9 +2,9 @@
 [Unit]
 Description=TEST-62-RESTRICT-IFACES-allow-list
 [Service]
-ExecStart=sh -c 'ping -c 1 -W 0.2 192.168.113.1'
-ExecStart=sh -c 'ping -c 1 -W 0.2 192.168.113.5'
-ExecStart=sh -c '! ping -c 1 -W 0.2 192.168.113.9'
+ExecStart=bash -c 'ping -c 1 -W 0.2 192.168.113.1'
+ExecStart=bash -c 'ping -c 1 -W 0.2 192.168.113.5'
+ExecStart=bash -c '! ping -c 1 -W 0.2 192.168.113.9'
 RestrictNetworkInterfaces=veth0
 RestrictNetworkInterfaces=veth1
 Type=oneshot
diff --git a/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-3.service b/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-3.service
index 116530bad3..bf70ab24a7 100644
--- a/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-3.service
+++ b/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-3.service
@@ -2,9 +2,9 @@
 [Unit]
 Description=TEST-62-RESTRICT-IFACES-deny-list
 [Service]
-ExecStart=sh -c '! ping -c 1 -W 0.2 192.168.113.1'
-ExecStart=sh -c '! ping -c 1 -W 0.2 192.168.113.5'
-ExecStart=sh -c 'ping -c 1 -W 0.2 192.168.113.9'
+ExecStart=bash -c '! ping -c 1 -W 0.2 192.168.113.1'
+ExecStart=bash -c '! ping -c 1 -W 0.2 192.168.113.5'
+ExecStart=bash -c 'ping -c 1 -W 0.2 192.168.113.9'
 RestrictNetworkInterfaces=~veth0
 RestrictNetworkInterfaces=~veth1
 Type=oneshot
diff --git a/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-4.service b/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-4.service
index 200a38355a..7e22a32b0c 100644
--- a/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-4.service
+++ b/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-4.service
@@ -2,9 +2,9 @@
 [Unit]
 Description=TEST-62-RESTRICT-IFACES-empty-assignment
 [Service]
-ExecStart=sh -c 'ping -c 1 -W 0.2 192.168.113.1'
-ExecStart=sh -c 'ping -c 1 -W 0.2 192.168.113.5'
-ExecStart=sh -c 'ping -c 1 -W 0.2 192.168.113.9'
+ExecStart=bash -c 'ping -c 1 -W 0.2 192.168.113.1'
+ExecStart=bash -c 'ping -c 1 -W 0.2 192.168.113.5'
+ExecStart=bash -c 'ping -c 1 -W 0.2 192.168.113.9'
 RestrictNetworkInterfaces=veth0
 RestrictNetworkInterfaces=
 Type=oneshot
diff --git a/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-5.service b/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-5.service
index 51761ba27e..20fe462918 100644
--- a/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-5.service
+++ b/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-5.service
@@ -2,9 +2,9 @@
 [Unit]
 Description=TEST-62-RESTRICT-IFACES-invert-assignment
 [Service]
-ExecStart=sh -c '! ping -c 1 -W 0.2 192.168.113.1'
-ExecStart=sh -c 'ping -c 1 -W 0.2 192.168.113.5'
-ExecStart=sh -c '! ping -c 1 -W 0.2 192.168.113.9'
+ExecStart=bash -c '! ping -c 1 -W 0.2 192.168.113.1'
+ExecStart=bash -c 'ping -c 1 -W 0.2 192.168.113.5'
+ExecStart=bash -c '! ping -c 1 -W 0.2 192.168.113.9'
 RestrictNetworkInterfaces=veth0
 RestrictNetworkInterfaces=veth0 veth1
 RestrictNetworkInterfaces=~veth0
diff --git a/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-6.service b/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-6.service
index b7e91f7e68..e0c13ca5d1 100644
--- a/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-6.service
+++ b/test/integration-tests/TEST-62-RESTRICT-IFACES/TEST-62-RESTRICT-IFACES.units/TEST-62-RESTRICT-IFACES-6.service
@@ -2,9 +2,9 @@
 [Unit]
 Description=TEST-62-RESTRICT-IFACES-altname
 [Service]
-ExecStart=sh -c 'ping -c 1 -W 0.2 192.168.113.1'
-ExecStart=sh -c 'ping -c 1 -W 0.2 192.168.113.5'
-ExecStart=sh -c '! ping -c 1 -W 0.2 192.168.113.9'
+ExecStart=bash -c 'ping -c 1 -W 0.2 192.168.113.1'
+ExecStart=bash -c 'ping -c 1 -W 0.2 192.168.113.5'
+ExecStart=bash -c '! ping -c 1 -W 0.2 192.168.113.9'
 RestrictNetworkInterfaces=veth0-altname-with-more-than-15-chars
 RestrictNetworkInterfaces=veth1-altname-with-more-than-15-chars
 Type=oneshot
diff --git a/test/integration-tests/TEST-63-PATH/TEST-63-PATH.units/test63-glob.service b/test/integration-tests/TEST-63-PATH/TEST-63-PATH.units/test63-glob.service
index 3f49dd4620..50818a8d10 100644
--- a/test/integration-tests/TEST-63-PATH/TEST-63-PATH.units/test63-glob.service
+++ b/test/integration-tests/TEST-63-PATH/TEST-63-PATH.units/test63-glob.service
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 [Service]
-ExecStartPre=sh -c 'test "$TRIGGER_PATH" = /tmp/test63-glob-foo'
-ExecStartPre=sh -c 'test "$TRIGGER_UNIT" = test63-glob.path'
+ExecStartPre=bash -c 'test "$TRIGGER_PATH" = /tmp/test63-glob-foo'
+ExecStartPre=bash -c 'test "$TRIGGER_UNIT" = test63-glob.path'
 ExecStart=systemd-notify --ready
 RemainAfterExit=yes
 Type=notify
diff --git a/test/integration-tests/TEST-63-PATH/TEST-63-PATH.units/test63.service b/test/integration-tests/TEST-63-PATH/TEST-63-PATH.units/test63.service
index 01a928b8d6..b6360f7794 100644
--- a/test/integration-tests/TEST-63-PATH/TEST-63-PATH.units/test63.service
+++ b/test/integration-tests/TEST-63-PATH/TEST-63-PATH.units/test63.service
@@ -3,6 +3,6 @@
 ConditionPathExists=/tmp/nonexistent
 
 [Service]
-ExecStartPre=sh -c 'test "$TRIGGER_PATH" = /tmp/test63'
-ExecStartPre=sh -c 'test "$TRIGGER_UNIT" = test63.path'
+ExecStartPre=bash -c 'test "$TRIGGER_PATH" = /tmp/test63'
+ExecStartPre=bash -c 'test "$TRIGGER_UNIT" = test63.path'
 ExecStart=true
diff --git a/test/test-execute/exec-ambientcapabilities-dynuser.service b/test/test-execute/exec-ambientcapabilities-dynuser.service
index b927c7dbca..7e3faffcc7 100644
--- a/test/test-execute/exec-ambientcapabilities-dynuser.service
+++ b/test/test-execute/exec-ambientcapabilities-dynuser.service
@@ -3,7 +3,7 @@
 Description=Test for AmbientCapabilities (dynamic user)
 
 [Service]
-ExecStart=sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000002081"'
+ExecStart=bash -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000002081"'
 Type=oneshot
 AmbientCapabilities=CAP_CHOWN CAP_SETUID CAP_NET_RAW
 DynamicUser=yes
diff --git a/test/test-execute/exec-ambientcapabilities-merge-nfsnobody.service b/test/test-execute/exec-ambientcapabilities-merge-nfsnobody.service
index a170b3d7b6..d2a30ef851 100644
--- a/test/test-execute/exec-ambientcapabilities-merge-nfsnobody.service
+++ b/test/test-execute/exec-ambientcapabilities-merge-nfsnobody.service
@@ -3,7 +3,7 @@
 Description=Test for AmbientCapabilities
 
 [Service]
-ExecStart=sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000002001"'
+ExecStart=bash -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000002001"'
 Type=oneshot
 User=nfsnobody
 AmbientCapabilities=CAP_CHOWN
diff --git a/test/test-execute/exec-ambientcapabilities-merge-nobody.service b/test/test-execute/exec-ambientcapabilities-merge-nobody.service
index 2e21bbc58a..af6cf01771 100644
--- a/test/test-execute/exec-ambientcapabilities-merge-nobody.service
+++ b/test/test-execute/exec-ambientcapabilities-merge-nobody.service
@@ -3,7 +3,7 @@
 Description=Test for AmbientCapabilities
 
 [Service]
-ExecStart=sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000002001"'
+ExecStart=bash -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000002001"'
 Type=oneshot
 User=nobody
 AmbientCapabilities=CAP_CHOWN
diff --git a/test/test-execute/exec-ambientcapabilities-merge.service b/test/test-execute/exec-ambientcapabilities-merge.service
index c4bb21b2ac..fc5e9b1ffe 100644
--- a/test/test-execute/exec-ambientcapabilities-merge.service
+++ b/test/test-execute/exec-ambientcapabilities-merge.service
@@ -3,7 +3,7 @@
 Description=Test for AmbientCapabilities (daemon)
 
 [Service]
-ExecStart=sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000002001"'
+ExecStart=bash -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000002001"'
 Type=oneshot
 User=daemon
 AmbientCapabilities=CAP_CHOWN
diff --git a/test/test-execute/exec-ambientcapabilities-nfsnobody.service b/test/test-execute/exec-ambientcapabilities-nfsnobody.service
index 0bf91cc98f..6670018baa 100644
--- a/test/test-execute/exec-ambientcapabilities-nfsnobody.service
+++ b/test/test-execute/exec-ambientcapabilities-nfsnobody.service
@@ -3,7 +3,7 @@
 Description=Test for AmbientCapabilities
 
 [Service]
-ExecStart=sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000002001"'
+ExecStart=bash -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000002001"'
 Type=oneshot
 User=nfsnobody
 AmbientCapabilities=CAP_CHOWN CAP_NET_RAW
diff --git a/test/test-execute/exec-ambientcapabilities-nobody.service b/test/test-execute/exec-ambientcapabilities-nobody.service
index 8bd7ac4f90..c8438f2ee1 100644
--- a/test/test-execute/exec-ambientcapabilities-nobody.service
+++ b/test/test-execute/exec-ambientcapabilities-nobody.service
@@ -3,7 +3,7 @@
 Description=Test for AmbientCapabilities
 
 [Service]
-ExecStart=sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000002001"'
+ExecStart=bash -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000002001"'
 Type=oneshot
 User=nobody
 AmbientCapabilities=CAP_CHOWN CAP_NET_RAW
diff --git a/test/test-execute/exec-ambientcapabilities.service b/test/test-execute/exec-ambientcapabilities.service
index 1bbc727031..1481ce0716 100644
--- a/test/test-execute/exec-ambientcapabilities.service
+++ b/test/test-execute/exec-ambientcapabilities.service
@@ -3,7 +3,7 @@
 Description=Test for AmbientCapabilities (daemon)
 
 [Service]
-ExecStart=sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000002001"'
+ExecStart=bash -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000002001"'
 Type=oneshot
 User=daemon
 AmbientCapabilities=CAP_CHOWN CAP_NET_RAW
diff --git a/test/test-execute/exec-basic.service b/test/test-execute/exec-basic.service
index c29d46c2df..b6cdb10391 100644
--- a/test/test-execute/exec-basic.service
+++ b/test/test-execute/exec-basic.service
@@ -27,7 +27,7 @@ ConditionVersion=glibc " >= 2" " <= 9000 " "!= 1"
 ConditionVersion=glibc " >= 2" " * "
 
 [Service]
-ExecStart=touch /tmp/a ; /bin/sh -c 'touch /tmp/b' ; touch /tmp/c
+ExecStart=touch /tmp/a ; bash -c 'touch /tmp/b' ; touch /tmp/c
 ExecStart=test -f /tmp/a
 ExecStart=!test -f /tmp/b
 ExecStart=!!test -f /tmp/c
diff --git a/test/test-execute/exec-bindpaths.service b/test/test-execute/exec-bindpaths.service
index 12e92e2ac5..bc68058868 100644
--- a/test/test-execute/exec-bindpaths.service
+++ b/test/test-execute/exec-bindpaths.service
@@ -11,7 +11,7 @@ ExecStart=test -f /tmp/thisisasimpletest
 # Also, through /tmp/test-exec-bindreadonlypaths
 ExecStart=test -f /tmp/test-exec-bindreadonlypaths/thisisasimpletest
 # The file cannot modify through /tmp/test-exec-bindreadonlypaths
-ExecStart=sh -x -c '! touch /tmp/test-exec-bindreadonlypaths/thisisasimpletest'
+ExecStart=bash -x -c '! touch /tmp/test-exec-bindreadonlypaths/thisisasimpletest'
 # Cleanup
 ExecStart=rm /tmp/thisisasimpletest
 BindPaths=/tmp:/tmp/test-exec-bindpaths
diff --git a/test/test-execute/exec-capabilityboundingset-invert.service b/test/test-execute/exec-capabilityboundingset-invert.service
index 14f16c6b56..92aabc5875 100644
--- a/test/test-execute/exec-capabilityboundingset-invert.service
+++ b/test/test-execute/exec-capabilityboundingset-invert.service
@@ -4,6 +4,6 @@ Description=Test for CapabilityBoundingSet
 
 [Service]
 # sed: remove dropped (cap_xxx-[epi]) and IAB capabilities from the output
-ExecStart=sh -x -c '! capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep "^Bounding set .*cap_chown"'
+ExecStart=bash -x -c '! capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep "^Bounding set .*cap_chown"'
 Type=oneshot
 CapabilityBoundingSet=~CAP_CHOWN
diff --git a/test/test-execute/exec-capabilityboundingset-merge.service b/test/test-execute/exec-capabilityboundingset-merge.service
index d3a23706ee..30746a93af 100644
--- a/test/test-execute/exec-capabilityboundingset-merge.service
+++ b/test/test-execute/exec-capabilityboundingset-merge.service
@@ -3,7 +3,7 @@
 Description=Test for CapabilityBoundingSet
 
 [Service]
-ExecStart=sh -x -c 'c=$$(capsh --print | grep "Bounding set "); test "$$c" = "Bounding set =cap_chown,cap_fowner,cap_kill"'
+ExecStart=bash -x -c 'c=$$(capsh --print | grep "Bounding set "); test "$$c" = "Bounding set =cap_chown,cap_fowner,cap_kill"'
 Type=oneshot
 CapabilityBoundingSet=CAP_FOWNER
 CapabilityBoundingSet=CAP_KILL CAP_CHOWN
diff --git a/test/test-execute/exec-capabilityboundingset-reset.service b/test/test-execute/exec-capabilityboundingset-reset.service
index 2443951651..7354a1cb83 100644
--- a/test/test-execute/exec-capabilityboundingset-reset.service
+++ b/test/test-execute/exec-capabilityboundingset-reset.service
@@ -3,7 +3,7 @@
 Description=Test for CapabilityBoundingSet
 
 [Service]
-ExecStart=sh -x -c 'c=$$(capsh --print | grep "Bounding set "); test "$$c" = "Bounding set ="'
+ExecStart=bash -x -c 'c=$$(capsh --print | grep "Bounding set "); test "$$c" = "Bounding set ="'
 Type=oneshot
 CapabilityBoundingSet=CAP_FOWNER CAP_KILL
 CapabilityBoundingSet=
diff --git a/test/test-execute/exec-capabilityboundingset-simple.service b/test/test-execute/exec-capabilityboundingset-simple.service
index 3df3e6d9ae..9c149264d3 100644
--- a/test/test-execute/exec-capabilityboundingset-simple.service
+++ b/test/test-execute/exec-capabilityboundingset-simple.service
@@ -3,6 +3,6 @@
 Description=Test for CapabilityBoundingSet
 
 [Service]
-ExecStart=sh -x -c 'c=$$(capsh --print | grep "Bounding set "); test "$$c" = "Bounding set =cap_fowner,cap_kill"'
+ExecStart=bash -x -c 'c=$$(capsh --print | grep "Bounding set "); test "$$c" = "Bounding set =cap_fowner,cap_kill"'
 Type=oneshot
 CapabilityBoundingSet=CAP_FOWNER CAP_KILL
diff --git a/test/test-execute/exec-condition-failed.service b/test/test-execute/exec-condition-failed.service
index eb136fff5d..6c6f6cfd12 100644
--- a/test/test-execute/exec-condition-failed.service
+++ b/test/test-execute/exec-condition-failed.service
@@ -6,7 +6,7 @@ Description=Test for exec condition that fails the unit
 Type=oneshot
 
 # exit 255 will fail the unit
-ExecCondition=/bin/sh -c 'exit 255'
+ExecCondition=bash -c 'exit 255'
 
 # This should not get run
-ExecStart=sh -c 'true'
+ExecStart=bash -c 'true'
diff --git a/test/test-execute/exec-condition-skip.service b/test/test-execute/exec-condition-skip.service
index 4ee58b9c11..554e7c6fbd 100644
--- a/test/test-execute/exec-condition-skip.service
+++ b/test/test-execute/exec-condition-skip.service
@@ -6,11 +6,11 @@ Description=Test for exec condition that triggers skipping
 Type=oneshot
 
 # exit codes [1, 254] will result in skipping the rest of execution
-ExecCondition=/bin/sh -c 'exit 0'
-ExecCondition=/bin/sh -c 'exit 254'
+ExecCondition=bash -c 'exit 0'
+ExecCondition=bash -c 'exit 254'
 
 # This would normally fail the unit but will not get run due to the skip above
-ExecCondition=/bin/sh -c 'exit 255'
+ExecCondition=bash -c 'exit 255'
 
 # This should not get run
-ExecStart=sh -c 'true'
+ExecStart=bash -c 'true'
diff --git a/test/test-execute/exec-cpuaffinity1.service b/test/test-execute/exec-cpuaffinity1.service
index c0941a5579..4229ebee4e 100644
--- a/test/test-execute/exec-cpuaffinity1.service
+++ b/test/test-execute/exec-cpuaffinity1.service
@@ -3,5 +3,5 @@
 Description=Test for CPUAffinity (simple)
 
 [Service]
-ExecStart=sh -c 'test $$(cat /proc/self/status | grep Cpus_allowed: | rev | cut -c 1) = 1'
+ExecStart=bash -c 'test $$(cat /proc/self/status | grep Cpus_allowed: | rev | cut -c 1) = 1'
 CPUAffinity=0
diff --git a/test/test-execute/exec-cpuaffinity2.service b/test/test-execute/exec-cpuaffinity2.service
index d699ecc031..e0d8e76d3b 100644
--- a/test/test-execute/exec-cpuaffinity2.service
+++ b/test/test-execute/exec-cpuaffinity2.service
@@ -3,7 +3,7 @@
 Description=Test for CPUAffinity (reset)
 
 [Service]
-ExecStart=sh -c 'test $$(cat /proc/self/status | grep Cpus_allowed: | rev | cut -c 1) = 1'
+ExecStart=bash -c 'test $$(cat /proc/self/status | grep Cpus_allowed: | rev | cut -c 1) = 1'
 CPUAffinity=0-1 3
 CPUAffinity=
 CPUAffinity=0
diff --git a/test/test-execute/exec-cpuaffinity3.service b/test/test-execute/exec-cpuaffinity3.service
index 8e8f782ac3..61ebd5b2ea 100644
--- a/test/test-execute/exec-cpuaffinity3.service
+++ b/test/test-execute/exec-cpuaffinity3.service
@@ -3,6 +3,6 @@
 Description=Test for CPUAffinity (merge)
 
 [Service]
-ExecStart=sh -c 'test $$(cat /proc/self/status | grep Cpus_allowed: | rev | cut -c 1) = 7'
+ExecStart=bash -c 'test $$(cat /proc/self/status | grep Cpus_allowed: | rev | cut -c 1) = 7'
 CPUAffinity=0,1
 CPUAffinity=1-2
diff --git a/test/test-execute/exec-credentials-dir-specifier.service b/test/test-execute/exec-credentials-dir-specifier.service
index 5e71eee246..2bc8f07248 100644
--- a/test/test-execute/exec-credentials-dir-specifier.service
+++ b/test/test-execute/exec-credentials-dir-specifier.service
@@ -9,10 +9,10 @@ Environment=TOP_SECRET=%d/very_top_secret
 ExecStart=test %d/very_top_secret = "${CREDENTIALS_DIRECTORY}/very_top_secret"
 LoadCredential=very_top_secret
 ExecStart=test %d/very_top_secret = "${CREDENTIALS_DIRECTORY}/very_top_secret"
-ExecStart=sh -c 'test %d/very_top_secret = "$TOP_SECRET"'
+ExecStart=bash -c 'test %d/very_top_secret = "$TOP_SECRET"'
 ExecStartPost=test %d/very_top_secret = "${CREDENTIALS_DIRECTORY}/very_top_secret"
-ExecStartPost=sh -c 'test %d/very_top_secret = "$TOP_SECRET"'
+ExecStartPost=bash -c 'test %d/very_top_secret = "$TOP_SECRET"'
 ExecStop=test %d/very_top_secret = "${CREDENTIALS_DIRECTORY}/very_top_secret"
-ExecStop=sh -c 'test %d/very_top_secret = "$TOP_SECRET"'
+ExecStop=bash -c 'test %d/very_top_secret = "$TOP_SECRET"'
 ExecStopPost=test %d/very_top_secret = "${CREDENTIALS_DIRECTORY}/very_top_secret"
-ExecStopPost=sh -c 'test %d/very_top_secret = "$TOP_SECRET"'
+ExecStopPost=bash -c 'test %d/very_top_secret = "$TOP_SECRET"'
diff --git a/test/test-execute/exec-dynamicuser-fixeduser-adm.service b/test/test-execute/exec-dynamicuser-fixeduser-adm.service
index 3a7f8aef60..5255a010ca 100644
--- a/test/test-execute/exec-dynamicuser-fixeduser-adm.service
+++ b/test/test-execute/exec-dynamicuser-fixeduser-adm.service
@@ -5,9 +5,9 @@ Description=Test DynamicUser with static User= whose uid and gid are different
 
 [Service]
 Type=oneshot
-ExecStart=sh -x -c 'test "$$(id -nG)" = "adm" && test "$$(id -ng)" = "adm" && test "$$(id -nu)" = "adm"'
+ExecStart=bash -x -c 'test "$$(id -nG)" = "adm" && test "$$(id -ng)" = "adm" && test "$$(id -nu)" = "adm"'
 # Multiple ExecStart= lines causes the issue #9702.
-ExecStart=sh -x -c 'test "$$(id -nG)" = "adm" && test "$$(id -ng)" = "adm" && test "$$(id -nu)" = "adm"'
+ExecStart=bash -x -c 'test "$$(id -nG)" = "adm" && test "$$(id -ng)" = "adm" && test "$$(id -nu)" = "adm"'
 DynamicUser=yes
 User=adm
 ReadWritePaths=-/coverage
diff --git a/test/test-execute/exec-dynamicuser-fixeduser-games.service b/test/test-execute/exec-dynamicuser-fixeduser-games.service
index 40048d27a8..29b712c9aa 100644
--- a/test/test-execute/exec-dynamicuser-fixeduser-games.service
+++ b/test/test-execute/exec-dynamicuser-fixeduser-games.service
@@ -5,9 +5,9 @@ Description=Test DynamicUser with static User= whose uid and gid are different
 
 [Service]
 Type=oneshot
-ExecStart=sh -x -c 'test "$$(id -nG)" = "games" && test "$$(id -ng)" = "games" && test "$$(id -nu)" = "games"'
+ExecStart=bash -x -c 'test "$$(id -nG)" = "games" && test "$$(id -ng)" = "games" && test "$$(id -nu)" = "games"'
 # Multiple ExecStart= lines causes the issue #9702.
-ExecStart=sh -x -c 'test "$$(id -nG)" = "games" && test "$$(id -ng)" = "games" && test "$$(id -nu)" = "games"'
+ExecStart=bash -x -c 'test "$$(id -nG)" = "games" && test "$$(id -ng)" = "games" && test "$$(id -nu)" = "games"'
 DynamicUser=yes
 User=games
 ReadWritePaths=-/coverage
diff --git a/test/test-execute/exec-dynamicuser-fixeduser-one-supplementarygroup.service b/test/test-execute/exec-dynamicuser-fixeduser-one-supplementarygroup.service
index e58b524033..8a4eabb894 100644
--- a/test/test-execute/exec-dynamicuser-fixeduser-one-supplementarygroup.service
+++ b/test/test-execute/exec-dynamicuser-fixeduser-one-supplementarygroup.service
@@ -3,8 +3,8 @@
 Description=Test DynamicUser with User= and SupplementaryGroups=
 
 [Service]
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
-ExecStart=sh -x -c 'test "$$(id -g)" = "1" && test "$$(id -u)" = "1"'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'test "$$(id -g)" = "1" && test "$$(id -u)" = "1"'
 Type=oneshot
 User=1
 DynamicUser=yes
diff --git a/test/test-execute/exec-dynamicuser-fixeduser.service b/test/test-execute/exec-dynamicuser-fixeduser.service
index 8e5244d891..412198b887 100644
--- a/test/test-execute/exec-dynamicuser-fixeduser.service
+++ b/test/test-execute/exec-dynamicuser-fixeduser.service
@@ -3,8 +3,8 @@
 Description=Test DynamicUser with User=
 
 [Service]
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
-ExecStart=sh -x -c 'test "$$(id -g)" = "1" && test "$$(id -u)" = "1"'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'test "$$(id -g)" = "1" && test "$$(id -u)" = "1"'
 Type=oneshot
 User=1
 DynamicUser=yes
diff --git a/test/test-execute/exec-dynamicuser-runtimedirectory1.service b/test/test-execute/exec-dynamicuser-runtimedirectory1.service
index 671b316736..30d28aee07 100644
--- a/test/test-execute/exec-dynamicuser-runtimedirectory1.service
+++ b/test/test-execute/exec-dynamicuser-runtimedirectory1.service
@@ -3,9 +3,9 @@
 Description=Test for RuntimeDirectory with RuntimeDirectoryPreserve=yes and DynamicUser=yes
 
 [Service]
-ExecStart=sh -x -c 'test -d %t/test-exec_runtimedirectorypreserve'
-ExecStart=sh -x -c 'test "$$RUNTIME_DIRECTORY" = "%t/test-exec_runtimedirectorypreserve"'
-ExecStart=sh -x -c 'touch $$RUNTIME_DIRECTORY/test'
+ExecStart=bash -x -c 'test -d %t/test-exec_runtimedirectorypreserve'
+ExecStart=bash -x -c 'test "$$RUNTIME_DIRECTORY" = "%t/test-exec_runtimedirectorypreserve"'
+ExecStart=bash -x -c 'touch $$RUNTIME_DIRECTORY/test'
 Type=oneshot
 RuntimeDirectory=test-exec_runtimedirectorypreserve
 RuntimeDirectoryPreserve=yes
diff --git a/test/test-execute/exec-dynamicuser-runtimedirectory2.service b/test/test-execute/exec-dynamicuser-runtimedirectory2.service
index cdb80848e3..ef9ba35c06 100644
--- a/test/test-execute/exec-dynamicuser-runtimedirectory2.service
+++ b/test/test-execute/exec-dynamicuser-runtimedirectory2.service
@@ -3,10 +3,10 @@
 Description=Test for RuntimeDirectory with RuntimeDirectoryPreserve=yes and DynamicUser=yes 2nd trial
 
 [Service]
-ExecStart=sh -x -c 'test -d %t/test-exec_runtimedirectorypreserve'
-ExecStart=sh -x -c 'test "$$RUNTIME_DIRECTORY" = "%t/test-exec_runtimedirectorypreserve"'
-ExecStart=sh -x -c 'test -f $$RUNTIME_DIRECTORY/test'
-ExecStart=sh -x -c 'touch $$RUNTIME_DIRECTORY/test'
+ExecStart=bash -x -c 'test -d %t/test-exec_runtimedirectorypreserve'
+ExecStart=bash -x -c 'test "$$RUNTIME_DIRECTORY" = "%t/test-exec_runtimedirectorypreserve"'
+ExecStart=bash -x -c 'test -f $$RUNTIME_DIRECTORY/test'
+ExecStart=bash -x -c 'touch $$RUNTIME_DIRECTORY/test'
 Type=oneshot
 RuntimeDirectory=test-exec_runtimedirectorypreserve
 RuntimeDirectoryPreserve=yes
diff --git a/test/test-execute/exec-dynamicuser-runtimedirectory3.service b/test/test-execute/exec-dynamicuser-runtimedirectory3.service
index 51a9e44c6f..a8ee6facf9 100644
--- a/test/test-execute/exec-dynamicuser-runtimedirectory3.service
+++ b/test/test-execute/exec-dynamicuser-runtimedirectory3.service
@@ -3,10 +3,10 @@
 Description=Test for RuntimeDirectory with DynamicUser=yes migrated from RuntimeDirectoryPreserve=yes
 
 [Service]
-ExecStart=sh -x -c 'test -d %t/test-exec_runtimedirectorypreserve'
-ExecStart=sh -x -c 'test "$$RUNTIME_DIRECTORY" = "%t/test-exec_runtimedirectorypreserve"'
-ExecStart=sh -x -c 'test -f $$RUNTIME_DIRECTORY/test'
-ExecStart=sh -x -c 'touch $$RUNTIME_DIRECTORY/test'
+ExecStart=bash -x -c 'test -d %t/test-exec_runtimedirectorypreserve'
+ExecStart=bash -x -c 'test "$$RUNTIME_DIRECTORY" = "%t/test-exec_runtimedirectorypreserve"'
+ExecStart=bash -x -c 'test -f $$RUNTIME_DIRECTORY/test'
+ExecStart=bash -x -c 'touch $$RUNTIME_DIRECTORY/test'
 Type=oneshot
 RuntimeDirectory=test-exec_runtimedirectorypreserve
 DynamicUser=yes
diff --git a/test/test-execute/exec-dynamicuser-statedir-migrate-step1.service b/test/test-execute/exec-dynamicuser-statedir-migrate-step1.service
index 12375afbb5..855a3aa64e 100644
--- a/test/test-execute/exec-dynamicuser-statedir-migrate-step1.service
+++ b/test/test-execute/exec-dynamicuser-statedir-migrate-step1.service
@@ -11,7 +11,7 @@ ExecStart=test -d %S/test-dynamicuser-migrate
 ExecStart=test -d %S/test-dynamicuser-migrate2/hoge
 ExecStart=touch %S/test-dynamicuser-migrate/yay
 ExecStart=touch %S/test-dynamicuser-migrate2/hoge/yayyay
-ExecStart=sh -x -c 'test "$$STATE_DIRECTORY" = "%S/test-dynamicuser-migrate:%S/test-dynamicuser-migrate2/hoge"'
+ExecStart=bash -x -c 'test "$$STATE_DIRECTORY" = "%S/test-dynamicuser-migrate:%S/test-dynamicuser-migrate2/hoge"'
 
 Type=oneshot
 DynamicUser=no
diff --git a/test/test-execute/exec-dynamicuser-statedir-migrate-step2.service b/test/test-execute/exec-dynamicuser-statedir-migrate-step2.service
index f22862378c..92a421bfc1 100644
--- a/test/test-execute/exec-dynamicuser-statedir-migrate-step2.service
+++ b/test/test-execute/exec-dynamicuser-statedir-migrate-step2.service
@@ -19,7 +19,7 @@ ExecStart=touch %S/test-dynamicuser-migrate/yay
 ExecStart=touch %S/test-dynamicuser-migrate2/hoge/yayyay
 ExecStart=touch %S/private/test-dynamicuser-migrate/yay
 ExecStart=touch %S/private/test-dynamicuser-migrate2/hoge/yayyay
-ExecStart=sh -x -c 'test "$$STATE_DIRECTORY" = "%S/test-dynamicuser-migrate:%S/test-dynamicuser-migrate2/hoge"'
+ExecStart=bash -x -c 'test "$$STATE_DIRECTORY" = "%S/test-dynamicuser-migrate:%S/test-dynamicuser-migrate2/hoge"'
 
 Type=oneshot
 DynamicUser=yes
diff --git a/test/test-execute/exec-dynamicuser-statedir.service b/test/test-execute/exec-dynamicuser-statedir.service
index 1e4fe818ac..d52684ebde 100644
--- a/test/test-execute/exec-dynamicuser-statedir.service
+++ b/test/test-execute/exec-dynamicuser-statedir.service
@@ -78,7 +78,7 @@ ExecStart=test -f %S/private/xxx/foo
 ExecStart=test -f %S/private/xxx/yyy/foo
 ExecStart=test -f %S/private/xxx/zzz/foo
 
-ExecStart=sh -x -c 'test "$$STATE_DIRECTORY" = "%S/aaa:%S/aaa/bbb:%S/aaa/ccc:%S/abc:%S/quux/pief:%S/waldo:%S/xxx:%S/xxx/yyy:%S/xxx/zzz"'
+ExecStart=bash -x -c 'test "$$STATE_DIRECTORY" = "%S/aaa:%S/aaa/bbb:%S/aaa/ccc:%S/abc:%S/quux/pief:%S/waldo:%S/xxx:%S/xxx/yyy:%S/xxx/zzz"'
 
 Type=oneshot
 DynamicUser=yes
diff --git a/test/test-execute/exec-dynamicuser-supplementarygroups.service b/test/test-execute/exec-dynamicuser-supplementarygroups.service
index fd88a790e4..13fc61599e 100644
--- a/test/test-execute/exec-dynamicuser-supplementarygroups.service
+++ b/test/test-execute/exec-dynamicuser-supplementarygroups.service
@@ -3,8 +3,8 @@
 Description=Test DynamicUser with SupplementaryGroups=
 
 [Service]
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "2" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "2" && exit 0; done; exit 1'
 Type=oneshot
 DynamicUser=yes
 SupplementaryGroups=1 2
diff --git a/test/test-execute/exec-environment-empty.service b/test/test-execute/exec-environment-empty.service
index e5af6ffe68..ff373d51b0 100644
--- a/test/test-execute/exec-environment-empty.service
+++ b/test/test-execute/exec-environment-empty.service
@@ -3,7 +3,7 @@
 Description=Test for Environment
 
 [Service]
-ExecStart=sh -x -c 'test "$${VAR1-unset}" = "unset" && test "$${VAR2-unset}" = "unset" && test "$${VAR3-unset}" = "unset"'
+ExecStart=bash -x -c 'test "$${VAR1-unset}" = "unset" && test "$${VAR2-unset}" = "unset" && test "$${VAR3-unset}" = "unset"'
 Type=oneshot
 Environment="VAR1=word1 word2" VAR2=word3 "VAR3=$word 5 6"
 Environment=
diff --git a/test/test-execute/exec-environment-multiple.service b/test/test-execute/exec-environment-multiple.service
index 4199a46d84..c6565f492b 100644
--- a/test/test-execute/exec-environment-multiple.service
+++ b/test/test-execute/exec-environment-multiple.service
@@ -3,7 +3,7 @@
 Description=Test for Environment
 
 [Service]
-ExecStart=sh -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = foobar'
+ExecStart=bash -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = foobar'
 Type=oneshot
 Environment="VAR1=word1 word2" VAR2=word3 "VAR3=$word 5 6"
 Environment="VAR3=foobar"
diff --git a/test/test-execute/exec-environment-no-substitute.service b/test/test-execute/exec-environment-no-substitute.service
index 7396576d7d..6748c1292a 100644
--- a/test/test-execute/exec-environment-no-substitute.service
+++ b/test/test-execute/exec-environment-no-substitute.service
@@ -3,7 +3,7 @@
 Description=Test for No Environment Variable Substitution
 
 [Service]
-ExecStart=sh -x -c 'test "$${VAR1-unset}" = "unset" && test "$${VAR2}" = "word3" && test "$${VAR3-unset}" = \'$word 5 6\''
-ExecStart=:/bin/sh -x -c 'test "$${VAR1-unset}" != "unset" && test "$${VAR2}" != "word3" && test "$${VAR3-unset}" != \'$word 5 6\''
+ExecStart=bash -x -c 'test "$${VAR1-unset}" = "unset" && test "$${VAR2}" = "word3" && test "$${VAR3-unset}" = \'$word 5 6\''
+ExecStart=:bash -x -c 'test "$${VAR1-unset}" != "unset" && test "$${VAR2}" != "word3" && test "$${VAR3-unset}" != \'$word 5 6\''
 Type=oneshot
 Environment="VAR2=word3" "VAR3=$word 5 6"
diff --git a/test/test-execute/exec-environment.service b/test/test-execute/exec-environment.service
index 7e3cb0ef42..d20875840c 100644
--- a/test/test-execute/exec-environment.service
+++ b/test/test-execute/exec-environment.service
@@ -3,6 +3,6 @@
 Description=Test for Environment
 
 [Service]
-ExecStart=sh -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6"'
+ExecStart=bash -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6"'
 Type=oneshot
 Environment="VAR1=word1 word2" VAR2=word3 "VAR3=$word 5 6"
diff --git a/test/test-execute/exec-environmentfile.service b/test/test-execute/exec-environmentfile.service
index 3f739fa1e0..4331dd2109 100644
--- a/test/test-execute/exec-environmentfile.service
+++ b/test/test-execute/exec-environmentfile.service
@@ -3,6 +3,6 @@
 Description=Test for EnvironmentFile
 
 [Service]
-ExecStart=sh -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$VAR4" = "new\nline" && test "$$VAR5" = passwordwithbackslashes'
+ExecStart=bash -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$VAR4" = "new\nline" && test "$$VAR5" = passwordwithbackslashes'
 Type=oneshot
 EnvironmentFile=/tmp/test-exec_environmentfile.conf
diff --git a/test/test-execute/exec-execsearchpath-environment-path-set.service b/test/test-execute/exec-execsearchpath-environment-path-set.service
index 424c4ac7b6..b6d3481d27 100644
--- a/test/test-execute/exec-execsearchpath-environment-path-set.service
+++ b/test/test-execute/exec-execsearchpath-environment-path-set.service
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 [Service]
-ExecStart=sh -x -c 'test "$$PATH" = "/usr" && test "$$VAR1" = word3 && test "$$VAR2" = "\\$$word 5 6"'
+ExecStart=bash -x -c 'test "$$PATH" = "/usr" && test "$$VAR1" = word3 && test "$$VAR2" = "\\$$word 5 6"'
 Type=oneshot
 ExecSearchPath=/tmp:/bin
 Environment="PATH=/usr" VAR1=word3 "VAR2=$word 5 6"
diff --git a/test/test-execute/exec-execsearchpath-environment.service b/test/test-execute/exec-execsearchpath-environment.service
index 5c39d9ca63..aed95cbe9e 100644
--- a/test/test-execute/exec-execsearchpath-environment.service
+++ b/test/test-execute/exec-execsearchpath-environment.service
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 [Service]
-ExecStart=sh -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$PATH" = "/tmp:/bin"'
+ExecStart=bash -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$PATH" = "/tmp:/bin"'
 Type=oneshot
 ExecSearchPath=/tmp:/bin
 Environment="VAR1=word1 word2" VAR2=word3 "VAR3=$word 5 6"
diff --git a/test/test-execute/exec-execsearchpath-environmentfile-set.service b/test/test-execute/exec-execsearchpath-environmentfile-set.service
index 8741582231..279c83da10 100644
--- a/test/test-execute/exec-execsearchpath-environmentfile-set.service
+++ b/test/test-execute/exec-execsearchpath-environmentfile-set.service
@@ -3,7 +3,7 @@
 Description=Test for ExecSearchPath with EnvironmentFile where EnvironmentFile sets PATH
 
 [Service]
-ExecStart=sh -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$VAR4" = "new\nline" && test "$$VAR5" = passwordwithbackslashes && test "$$PATH" = /usr'
+ExecStart=bash -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$VAR4" = "new\nline" && test "$$VAR5" = passwordwithbackslashes && test "$$PATH" = /usr'
 Type=oneshot
 EnvironmentFile=/tmp/test-exec_execsearchpath_environmentfile-set.conf
 ExecSearchPath=/tmp:/bin
diff --git a/test/test-execute/exec-execsearchpath-environmentfile.service b/test/test-execute/exec-execsearchpath-environmentfile.service
index 53cede8f1b..29150f4b9f 100644
--- a/test/test-execute/exec-execsearchpath-environmentfile.service
+++ b/test/test-execute/exec-execsearchpath-environmentfile.service
@@ -3,7 +3,7 @@
 Description=Test for ExecSearchPath with EnvironmentFile where EnvironmentFile does not set PATH
 
 [Service]
-ExecStart=sh -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$VAR4" = "new\nline" && test "$$VAR5" = passwordwithbackslashes && test "$$PATH" = "/tmp:/bin"'
+ExecStart=bash -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$VAR4" = "new\nline" && test "$$VAR5" = passwordwithbackslashes && test "$$PATH" = "/tmp:/bin"'
 Type=oneshot
 ExecSearchPath=/tmp:/bin
 EnvironmentFile=/tmp/test-exec_execsearchpath_environmentfile.conf
diff --git a/test/test-execute/exec-execsearchpath-passenvironment-set.service b/test/test-execute/exec-execsearchpath-passenvironment-set.service
index 2d4e75a0c8..05e8f93dbd 100644
--- a/test/test-execute/exec-execsearchpath-passenvironment-set.service
+++ b/test/test-execute/exec-execsearchpath-passenvironment-set.service
@@ -3,7 +3,7 @@
 Description=Test for PassEnvironment with ExecSearchPath with PATH set by user
 
 [Service]
-ExecStart=sh -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$VAR4" = "new\nline" && test "$$VAR5" = passwordwithbackslashes && test "$$PATH" = "/usr"'
+ExecStart=bash -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$VAR4" = "new\nline" && test "$$VAR5" = passwordwithbackslashes && test "$$PATH" = "/usr"'
 Type=oneshot
 PassEnvironment=VAR1 VAR2 VAR3 VAR4 VAR5 PATH
 ExecSearchPath=/tmp:/bin
diff --git a/test/test-execute/exec-execsearchpath-passenvironment.service b/test/test-execute/exec-execsearchpath-passenvironment.service
index 5bdab47193..373afcee7b 100644
--- a/test/test-execute/exec-execsearchpath-passenvironment.service
+++ b/test/test-execute/exec-execsearchpath-passenvironment.service
@@ -3,7 +3,7 @@
 Description=Test for PassEnvironment with ExecSearchPath with PATH not set by user
 
 [Service]
-ExecStart=sh -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$VAR4" = "new\nline" && test "$$VAR5" = passwordwithbackslashes && test "$$PATH" = "/tmp:/bin"'
+ExecStart=bash -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$VAR4" = "new\nline" && test "$$VAR5" = passwordwithbackslashes && test "$$PATH" = "/tmp:/bin"'
 Type=oneshot
 PassEnvironment=VAR1 VAR2 VAR3 VAR4 VAR5
 ExecSearchPath=/tmp:/bin
diff --git a/test/test-execute/exec-execsearchpath-unit-specifier.service b/test/test-execute/exec-execsearchpath-unit-specifier.service
index a2037e930d..56e4f3f563 100644
--- a/test/test-execute/exec-execsearchpath-unit-specifier.service
+++ b/test/test-execute/exec-execsearchpath-unit-specifier.service
@@ -5,4 +5,4 @@ Description=Test for specifiers with exec search path
 [Service]
 Type=oneshot
 ExecSearchPath=/tmp:/bin:/usr/bin:%V
-ExecStart=sh -x -c 'test %V = /var/tmp && test "$$PATH" = "/tmp:/bin:/usr/bin:/var/tmp"'
+ExecStart=bash -x -c 'test %V = /var/tmp && test "$$PATH" = "/tmp:/bin:/usr/bin:/var/tmp"'
diff --git a/test/test-execute/exec-group-nfsnobody.service b/test/test-execute/exec-group-nfsnobody.service
index aebb1984a1..b9d0ac9a8b 100644
--- a/test/test-execute/exec-group-nfsnobody.service
+++ b/test/test-execute/exec-group-nfsnobody.service
@@ -3,6 +3,6 @@
 Description=Test for Group
 
 [Service]
-ExecStart=sh -x -c 'test "$$(id -n -g)" = "nfsnobody"'
+ExecStart=bash -x -c 'test "$$(id -n -g)" = "nfsnobody"'
 Type=oneshot
 Group=nfsnobody
diff --git a/test/test-execute/exec-group-nobody.service b/test/test-execute/exec-group-nobody.service
index cf283cb657..c4adb5f8fa 100644
--- a/test/test-execute/exec-group-nobody.service
+++ b/test/test-execute/exec-group-nobody.service
@@ -3,6 +3,6 @@
 Description=Test for Group
 
 [Service]
-ExecStart=sh -x -c 'test "$$(id -n -g)" = "nobody"'
+ExecStart=bash -x -c 'test "$$(id -n -g)" = "nobody"'
 Type=oneshot
 Group=nobody
diff --git a/test/test-execute/exec-group-nogroup.service b/test/test-execute/exec-group-nogroup.service
index 46c3dd3acf..bfdc9afa66 100644
--- a/test/test-execute/exec-group-nogroup.service
+++ b/test/test-execute/exec-group-nogroup.service
@@ -3,6 +3,6 @@
 Description=Test for Group
 
 [Service]
-ExecStart=sh -x -c 'test "$$(id -n -g)" = "nogroup"'
+ExecStart=bash -x -c 'test "$$(id -n -g)" = "nogroup"'
 Type=oneshot
 Group=nogroup
diff --git a/test/test-execute/exec-group.service b/test/test-execute/exec-group.service
index bd5ac2db34..5bfc4e9a2d 100644
--- a/test/test-execute/exec-group.service
+++ b/test/test-execute/exec-group.service
@@ -3,6 +3,6 @@
 Description=Test for Group (daemon)
 
 [Service]
-ExecStart=sh -x -c 'test "$$(id -n -g)" = "daemon"'
+ExecStart=bash -x -c 'test "$$(id -n -g)" = "daemon"'
 Type=oneshot
 Group=daemon
diff --git a/test/test-execute/exec-ignoresigpipe-no.service b/test/test-execute/exec-ignoresigpipe-no.service
index ce8b258712..caedab1447 100644
--- a/test/test-execute/exec-ignoresigpipe-no.service
+++ b/test/test-execute/exec-ignoresigpipe-no.service
@@ -3,6 +3,6 @@
 Description=Test for IgnoreSIGPIPE=no
 
 [Service]
-ExecStart=sh -x -c 'kill -PIPE 0'
+ExecStart=bash -x -c 'kill -PIPE 0'
 Type=oneshot
 IgnoreSIGPIPE=no
diff --git a/test/test-execute/exec-ignoresigpipe-yes.service b/test/test-execute/exec-ignoresigpipe-yes.service
index a26f53c413..bc093c0c0a 100644
--- a/test/test-execute/exec-ignoresigpipe-yes.service
+++ b/test/test-execute/exec-ignoresigpipe-yes.service
@@ -3,6 +3,6 @@
 Description=Test for IgnoreSIGPIPE=yes
 
 [Service]
-ExecStart=sh -x -c 'kill -PIPE 0'
+ExecStart=bash -x -c 'kill -PIPE 0'
 Type=oneshot
 IgnoreSIGPIPE=yes
diff --git a/test/test-execute/exec-inaccessiblepaths-mount-propagation.service b/test/test-execute/exec-inaccessiblepaths-mount-propagation.service
index 8580f5208e..fbe754455c 100644
--- a/test/test-execute/exec-inaccessiblepaths-mount-propagation.service
+++ b/test/test-execute/exec-inaccessiblepaths-mount-propagation.service
@@ -4,5 +4,5 @@ Description=Test to make sure that InaccessiblePaths= disconnect mount propagati
 
 [Service]
 InaccessiblePaths=-/i-dont-exist
-ExecStart=sh -x -c 'd=$$(mktemp -d -p /tmp); trap "umount \'$$d\' && rmdir \'$$d\'" EXIT; mount -t tmpfs tmpfs "$$d"; grep "$$d" /proc/self/mountinfo && ! grep "$$d" /proc/$${PPID}/mountinfo && ! grep "$$d" /proc/1/mountinfo'
+ExecStart=bash -x -c 'd=$$(mktemp -d -p /tmp); trap "umount \'$$d\' && rmdir \'$$d\'" EXIT; mount -t tmpfs tmpfs "$$d"; grep "$$d" /proc/self/mountinfo && ! grep "$$d" /proc/$${PPID}/mountinfo && ! grep "$$d" /proc/1/mountinfo'
 Type=oneshot
diff --git a/test/test-execute/exec-inaccessiblepaths-sys.service b/test/test-execute/exec-inaccessiblepaths-sys.service
index 64a570ce4d..599b7c854c 100644
--- a/test/test-execute/exec-inaccessiblepaths-sys.service
+++ b/test/test-execute/exec-inaccessiblepaths-sys.service
@@ -4,5 +4,5 @@ Description=Test to make sure that mount namespace setup works properly with the
 
 [Service]
 InaccessiblePaths=/sys
-ExecStart=sh -x -c 'test "$$(stat -c %%a /sys)" = "0"'
+ExecStart=bash -x -c 'test "$$(stat -c %%a /sys)" = "0"'
 Type=oneshot
diff --git a/test/test-execute/exec-ioschedulingclass-best-effort.service b/test/test-execute/exec-ioschedulingclass-best-effort.service
index 569183f173..a98d54c7cf 100644
--- a/test/test-execute/exec-ioschedulingclass-best-effort.service
+++ b/test/test-execute/exec-ioschedulingclass-best-effort.service
@@ -3,6 +3,6 @@
 Description=Test for IOSchedulingClass=best-effort
 
 [Service]
-ExecStart=sh -x -c 'c=$$(LC_ALL=C ionice); test "$${c%%:*}" = "best-effort"'
+ExecStart=bash -x -c 'c=$$(LC_ALL=C ionice); test "$${c%%:*}" = "best-effort"'
 Type=oneshot
 IOSchedulingClass=best-effort
diff --git a/test/test-execute/exec-ioschedulingclass-idle.service b/test/test-execute/exec-ioschedulingclass-idle.service
index 93377ea0c0..7a62682478 100644
--- a/test/test-execute/exec-ioschedulingclass-idle.service
+++ b/test/test-execute/exec-ioschedulingclass-idle.service
@@ -3,6 +3,6 @@
 Description=Test for IOSchedulingClass=idle
 
 [Service]
-ExecStart=sh -x -c 'c=$$(LC_ALL=C ionice); test "$${c%%:*}" = "idle"'
+ExecStart=bash -x -c 'c=$$(LC_ALL=C ionice); test "$${c%%:*}" = "idle"'
 Type=oneshot
 IOSchedulingClass=idle
diff --git a/test/test-execute/exec-ioschedulingclass-none.service b/test/test-execute/exec-ioschedulingclass-none.service
index b8198d16f2..313eca79c5 100644
--- a/test/test-execute/exec-ioschedulingclass-none.service
+++ b/test/test-execute/exec-ioschedulingclass-none.service
@@ -4,6 +4,6 @@ Description=Test for IOSchedulingClass=none
 
 [Service]
 # Old kernels might report "none" here, new kernels "best-effort".
-ExecStart=sh -x -c 'c=$$(LC_ALL=C ionice); test "$${c%%:*}" = "none" -o "$${c%%:*}" = "best-effort"'
+ExecStart=bash -x -c 'c=$$(LC_ALL=C ionice); test "$${c%%:*}" = "none" -o "$${c%%:*}" = "best-effort"'
 Type=oneshot
 IOSchedulingClass=none
diff --git a/test/test-execute/exec-ioschedulingclass-realtime.service b/test/test-execute/exec-ioschedulingclass-realtime.service
index a7edb6d012..83ad99e6d4 100644
--- a/test/test-execute/exec-ioschedulingclass-realtime.service
+++ b/test/test-execute/exec-ioschedulingclass-realtime.service
@@ -3,6 +3,6 @@
 Description=Test for IOSchedulingClass=realtime
 
 [Service]
-ExecStart=sh -x -c 'c=$$(LC_ALL=C ionice); test "$${c%%:*}" = "realtime"'
+ExecStart=bash -x -c 'c=$$(LC_ALL=C ionice); test "$${c%%:*}" = "realtime"'
 Type=oneshot
 IOSchedulingClass=realtime
diff --git a/test/test-execute/exec-load-credential.service b/test/test-execute/exec-load-credential.service
index 9da19e6369..d8a0a14b86 100644
--- a/test/test-execute/exec-load-credential.service
+++ b/test/test-execute/exec-load-credential.service
@@ -3,9 +3,9 @@
 Description=Test for LoadCredential=
 
 [Service]
-ExecStart=sh -x -c 'test "$$(cat %d/test-execute.load-credential)" = "foo"'
-ExecStartPost=sh -x -c 'test "$$(cat %d/test-execute.load-credential)" = "foo"'
-ExecStop=sh -x -c 'test "$$(cat %d/test-execute.load-credential)" = "foo"'
-ExecStopPost=sh -x -c 'test "$$(cat %d/test-execute.load-credential)" = "foo"'
+ExecStart=bash -x -c 'test "$$(cat %d/test-execute.load-credential)" = "foo"'
+ExecStartPost=bash -x -c 'test "$$(cat %d/test-execute.load-credential)" = "foo"'
+ExecStop=bash -x -c 'test "$$(cat %d/test-execute.load-credential)" = "foo"'
+ExecStopPost=bash -x -c 'test "$$(cat %d/test-execute.load-credential)" = "foo"'
 Type=oneshot
 LoadCredential=test-execute.load-credential
diff --git a/test/test-execute/exec-networknamespacepath-privatemounts-no.service b/test/test-execute/exec-networknamespacepath-privatemounts-no.service
index 07c0525dcc..4aad58eb69 100644
--- a/test/test-execute/exec-networknamespacepath-privatemounts-no.service
+++ b/test/test-execute/exec-networknamespacepath-privatemounts-no.service
@@ -3,14 +3,14 @@
 Description=Test for NetworkNamespacePath= without mount namespacing
 
 [Service]
-ExecStart=sh -x -c '! ip link show dummy-test-exec'
-ExecStart=sh -x -c 'test ! -e /proc/sys/net/ipv4/conf/dummy-test-exec'
+ExecStart=bash -x -c '! ip link show dummy-test-exec'
+ExecStart=bash -x -c 'test ! -e /proc/sys/net/ipv4/conf/dummy-test-exec'
 # Without mount namespacing, we can access the dummy-test-exec interface through sysfs.
-ExecStart=sh -x -c 'test -e /sys/class/net/dummy-test-exec'
-ExecStart=sh -x -c 'ip link show dummy-test-ns'
-ExecStart=sh -x -c 'test -e /proc/sys/net/ipv4/conf/dummy-test-ns'
+ExecStart=bash -x -c 'test -e /sys/class/net/dummy-test-exec'
+ExecStart=bash -x -c 'ip link show dummy-test-ns'
+ExecStart=bash -x -c 'test -e /proc/sys/net/ipv4/conf/dummy-test-ns'
 # Without mount namespacing, we cannot access the dummy-test-ns interface through sysfs.
-ExecStart=sh -x -c 'test ! -e /sys/class/net/dummy-test-ns'
+ExecStart=bash -x -c 'test ! -e /sys/class/net/dummy-test-ns'
 Type=oneshot
 NetworkNamespacePath=/run/netns/test-execute-netns
 PrivateMounts=no
diff --git a/test/test-execute/exec-networknamespacepath-privatemounts-yes.service b/test/test-execute/exec-networknamespacepath-privatemounts-yes.service
index 10bc1923b7..9efd54ae6c 100644
--- a/test/test-execute/exec-networknamespacepath-privatemounts-yes.service
+++ b/test/test-execute/exec-networknamespacepath-privatemounts-yes.service
@@ -3,14 +3,14 @@
 Description=Test for NetworkNamespacePath= with mount namespacing
 
 [Service]
-ExecStart=sh -x -c '! ip link show dummy-test-exec'
-ExecStart=sh -x -c 'test ! -e /proc/sys/net/ipv4/conf/dummy-test-exec'
+ExecStart=bash -x -c '! ip link show dummy-test-exec'
+ExecStart=bash -x -c 'test ! -e /proc/sys/net/ipv4/conf/dummy-test-exec'
 # With mount namespacing, we cannot access the dummy-test-exec interface through sysfs.
-ExecStart=sh -x -c 'test ! -e /sys/class/net/dummy-test-exec'
-ExecStart=sh -x -c 'ip link show dummy-test-ns'
-ExecStart=sh -x -c 'test -e /proc/sys/net/ipv4/conf/dummy-test-ns'
+ExecStart=bash -x -c 'test ! -e /sys/class/net/dummy-test-exec'
+ExecStart=bash -x -c 'ip link show dummy-test-ns'
+ExecStart=bash -x -c 'test -e /proc/sys/net/ipv4/conf/dummy-test-ns'
 # With mount namespacing, we can access the dummy-test-ns interface through sysfs.
-ExecStart=sh -x -c 'test -e /sys/class/net/dummy-test-ns'
+ExecStart=bash -x -c 'test -e /sys/class/net/dummy-test-ns'
 Type=oneshot
 NetworkNamespacePath=/run/netns/test-execute-netns
 # NetworkNamespacePath= implies PrivateMounts=yes
diff --git a/test/test-execute/exec-noexecpaths-simple.service b/test/test-execute/exec-noexecpaths-simple.service
index 503be5a770..2eb8aae6ab 100644
--- a/test/test-execute/exec-noexecpaths-simple.service
+++ b/test/test-execute/exec-noexecpaths-simple.service
@@ -5,7 +5,7 @@ Description=Test for NoExecPaths=
 [Service]
 Type=oneshot
 # This should work, as we explicitly disable the effect of NoExecPaths=
-ExecStart=+/bin/sh -c '/bin/cat /dev/null'
+ExecStart=+bash -c '/bin/cat /dev/null'
 # This should also work, as we do not disable the effect of NoExecPaths= but invert the exit code
-ExecStart=sh -x -c '! /bin/cat /dev/null'
+ExecStart=bash -x -c '! /bin/cat /dev/null'
 NoExecPaths=/bin/cat
diff --git a/test/test-execute/exec-oomscoreadjust-negative.service b/test/test-execute/exec-oomscoreadjust-negative.service
index 5656030796..a6d3a52d4e 100644
--- a/test/test-execute/exec-oomscoreadjust-negative.service
+++ b/test/test-execute/exec-oomscoreadjust-negative.service
@@ -3,6 +3,6 @@
 Description=Test for OOMScoreAdjust
 
 [Service]
-ExecStart=sh -x -c 'c=$$(cat /proc/self/oom_score_adj); test "$$c" -eq -100'
+ExecStart=bash -x -c 'c=$$(cat /proc/self/oom_score_adj); test "$$c" -eq -100'
 Type=oneshot
 OOMScoreAdjust=-100
diff --git a/test/test-execute/exec-oomscoreadjust-positive.service b/test/test-execute/exec-oomscoreadjust-positive.service
index a2079b841e..1d903d3b7a 100644
--- a/test/test-execute/exec-oomscoreadjust-positive.service
+++ b/test/test-execute/exec-oomscoreadjust-positive.service
@@ -3,6 +3,6 @@
 Description=Test for OOMScoreAdjust
 
 [Service]
-ExecStart=sh -x -c 'c=$$(cat /proc/self/oom_score_adj); test "$$c" -eq 100'
+ExecStart=bash -x -c 'c=$$(cat /proc/self/oom_score_adj); test "$$c" -eq 100'
 Type=oneshot
 OOMScoreAdjust=100
diff --git a/test/test-execute/exec-passenvironment-absent.service b/test/test-execute/exec-passenvironment-absent.service
index b2e5c20016..1b92df85c7 100644
--- a/test/test-execute/exec-passenvironment-absent.service
+++ b/test/test-execute/exec-passenvironment-absent.service
@@ -3,6 +3,6 @@
 Description=Test for PassEnvironment with variables absent from the execution environment
 
 [Service]
-ExecStart=sh -x -c 'test "$${VAR1-unset}" = "unset" && test "$${VAR2-unset}" = "unset" && test "$${VAR3-unset}" = "unset" && test "$${VAR4-unset}" = "unset" && test "$${VAR5-unset}" = "unset"'
+ExecStart=bash -x -c 'test "$${VAR1-unset}" = "unset" && test "$${VAR2-unset}" = "unset" && test "$${VAR3-unset}" = "unset" && test "$${VAR4-unset}" = "unset" && test "$${VAR5-unset}" = "unset"'
 Type=oneshot
 PassEnvironment=VAR1 VAR2 VAR3 VAR4 VAR5
diff --git a/test/test-execute/exec-passenvironment-empty.service b/test/test-execute/exec-passenvironment-empty.service
index a5fd092783..21db61cbc1 100644
--- a/test/test-execute/exec-passenvironment-empty.service
+++ b/test/test-execute/exec-passenvironment-empty.service
@@ -3,7 +3,7 @@
 Description=Test for PassEnvironment and erasing the variable list
 
 [Service]
-ExecStart=sh -x -c 'test "$${VAR1-unset}" = "unset" && test "$${VAR2-unset}" = "unset" && test "$${VAR3-unset}" = "unset" && test "$${VAR4-unset}" = "unset" && test "$${VAR5-unset}" = "unset"'
+ExecStart=bash -x -c 'test "$${VAR1-unset}" = "unset" && test "$${VAR2-unset}" = "unset" && test "$${VAR3-unset}" = "unset" && test "$${VAR4-unset}" = "unset" && test "$${VAR5-unset}" = "unset"'
 Type=oneshot
 PassEnvironment=VAR1 VAR2 VAR3 VAR4 VAR5
 PassEnvironment=
diff --git a/test/test-execute/exec-passenvironment-repeated.service b/test/test-execute/exec-passenvironment-repeated.service
index f3b886c5c6..a2067a6aff 100644
--- a/test/test-execute/exec-passenvironment-repeated.service
+++ b/test/test-execute/exec-passenvironment-repeated.service
@@ -3,7 +3,7 @@
 Description=Test for PassEnvironment with a variable name repeated
 
 [Service]
-ExecStart=sh -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$VAR4" = "new\nline" && test "$$VAR5" = passwordwithbackslashes'
+ExecStart=bash -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$VAR4" = "new\nline" && test "$$VAR5" = passwordwithbackslashes'
 Type=oneshot
 PassEnvironment=VAR1 VAR2
 PassEnvironment=VAR1 VAR3
diff --git a/test/test-execute/exec-passenvironment.service b/test/test-execute/exec-passenvironment.service
index 1dcbcf97c8..5584aa3500 100644
--- a/test/test-execute/exec-passenvironment.service
+++ b/test/test-execute/exec-passenvironment.service
@@ -3,6 +3,6 @@
 Description=Test for PassEnvironment
 
 [Service]
-ExecStart=sh -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$VAR4" = "new\nline" && test "$$VAR5" = passwordwithbackslashes'
+ExecStart=bash -x -c 'test "$$VAR1" = "word1 word2" && test "$$VAR2" = word3 && test "$$VAR3" = "\\$$word 5 6" && test "$$VAR4" = "new\nline" && test "$$VAR5" = passwordwithbackslashes'
 Type=oneshot
 PassEnvironment=VAR1 VAR2 VAR3 VAR4 VAR5
diff --git a/test/test-execute/exec-personality-aarch64.service b/test/test-execute/exec-personality-aarch64.service
index e4ea294dcc..72afaf386b 100644
--- a/test/test-execute/exec-personality-aarch64.service
+++ b/test/test-execute/exec-personality-aarch64.service
@@ -3,6 +3,6 @@
 Description=Test for Personality=aarch64
 
 [Service]
-ExecStart=sh -c 'echo $(uname -m); exit $(test $(uname -m) = "aarch64")'
+ExecStart=bash -c 'echo $(uname -m); exit $(test $(uname -m) = "aarch64")'
 Type=oneshot
 Personality=aarch64
diff --git a/test/test-execute/exec-personality-loongarch64.service b/test/test-execute/exec-personality-loongarch64.service
index 31c6b258c7..689f35ff9e 100644
--- a/test/test-execute/exec-personality-loongarch64.service
+++ b/test/test-execute/exec-personality-loongarch64.service
@@ -2,6 +2,6 @@
 Description=Test for Personality=loongarch64
 
 [Service]
-ExecStart=sh -c 'echo $(uname -m); exit $(test $(uname -m) = "loongarch64")'
+ExecStart=bash -c 'echo $(uname -m); exit $(test $(uname -m) = "loongarch64")'
 Type=oneshot
 Personality=loongarch64
diff --git a/test/test-execute/exec-personality-ppc64.service b/test/test-execute/exec-personality-ppc64.service
index dd83bf66ee..3377c6b823 100644
--- a/test/test-execute/exec-personality-ppc64.service
+++ b/test/test-execute/exec-personality-ppc64.service
@@ -3,6 +3,6 @@
 Description=Test for Personality=ppc64
 
 [Service]
-ExecStart=sh -c 'echo $(uname -m); exit $(test $(uname -m) = "ppc64")'
+ExecStart=bash -c 'echo $(uname -m); exit $(test $(uname -m) = "ppc64")'
 Type=oneshot
 Personality=ppc64
diff --git a/test/test-execute/exec-personality-ppc64le.service b/test/test-execute/exec-personality-ppc64le.service
index 3f19d825db..f38c31b4c4 100644
--- a/test/test-execute/exec-personality-ppc64le.service
+++ b/test/test-execute/exec-personality-ppc64le.service
@@ -3,6 +3,6 @@
 Description=Test for Personality=ppc64le
 
 [Service]
-ExecStart=sh -c 'echo $(uname -m); exit $(test $(uname -m) = "ppc64le")'
+ExecStart=bash -c 'echo $(uname -m); exit $(test $(uname -m) = "ppc64le")'
 Type=oneshot
 Personality=ppc64le
diff --git a/test/test-execute/exec-personality-s390.service b/test/test-execute/exec-personality-s390.service
index 7d120cde2d..d81b90bcd4 100644
--- a/test/test-execute/exec-personality-s390.service
+++ b/test/test-execute/exec-personality-s390.service
@@ -3,6 +3,6 @@
 Description=Test for Personality=s390
 
 [Service]
-ExecStart=sh -x -c 'c=$$(uname -m); test "$$c" = "s390"'
+ExecStart=bash -x -c 'c=$$(uname -m); test "$$c" = "s390"'
 Type=oneshot
 Personality=s390
diff --git a/test/test-execute/exec-personality-s390x.service b/test/test-execute/exec-personality-s390x.service
index 4545dee4c3..10bcd37b69 100644
--- a/test/test-execute/exec-personality-s390x.service
+++ b/test/test-execute/exec-personality-s390x.service
@@ -3,6 +3,6 @@
 Description=Test for Personality=s390x
 
 [Service]
-ExecStart=sh -x -c 'c=$$(uname -m); test "$$c" = "s390x"'
+ExecStart=bash -x -c 'c=$$(uname -m); test "$$c" = "s390x"'
 Type=oneshot
 Personality=s390x
diff --git a/test/test-execute/exec-personality-x86-64.service b/test/test-execute/exec-personality-x86-64.service
index e7b945ca14..d2324001b5 100644
--- a/test/test-execute/exec-personality-x86-64.service
+++ b/test/test-execute/exec-personality-x86-64.service
@@ -3,6 +3,6 @@
 Description=Test for Personality=x86-64
 
 [Service]
-ExecStart=sh -x -c 'c=$$(uname -m); test "$$c" = "x86_64"'
+ExecStart=bash -x -c 'c=$$(uname -m); test "$$c" = "x86_64"'
 Type=oneshot
 Personality=x86-64
diff --git a/test/test-execute/exec-personality-x86.service b/test/test-execute/exec-personality-x86.service
index 95ec353cb1..1245d0b482 100644
--- a/test/test-execute/exec-personality-x86.service
+++ b/test/test-execute/exec-personality-x86.service
@@ -3,6 +3,6 @@
 Description=Test for Personality=x86
 
 [Service]
-ExecStart=sh -x -c 'c=$$(uname -m); test "$$c" = "i686" -o "$$c" = "x86_64"'
+ExecStart=bash -x -c 'c=$$(uname -m); test "$$c" = "i686" -o "$$c" = "x86_64"'
 Type=oneshot
 Personality=x86
diff --git a/test/test-execute/exec-privatedevices-bind.service b/test/test-execute/exec-privatedevices-bind.service
index c2229a4a7a..a74a4435a4 100644
--- a/test/test-execute/exec-privatedevices-bind.service
+++ b/test/test-execute/exec-privatedevices-bind.service
@@ -3,8 +3,8 @@
 Description=Test for PrivateDevices=yes with a bind mounted device
 
 [Service]
-ExecStart=sh -c 'test -c /dev/kmsg'
-ExecStart=sh -c 'test ! -w /dev/'
+ExecStart=bash -c 'test -c /dev/kmsg'
+ExecStart=bash -c 'test ! -w /dev/'
 Type=oneshot
 PrivateDevices=yes
 BindPaths=/dev/kmsg
diff --git a/test/test-execute/exec-privatedevices-disabled-by-prefix.service b/test/test-execute/exec-privatedevices-disabled-by-prefix.service
index 8f09c4ab95..eeea0b9355 100644
--- a/test/test-execute/exec-privatedevices-disabled-by-prefix.service
+++ b/test/test-execute/exec-privatedevices-disabled-by-prefix.service
@@ -3,7 +3,7 @@
 Description=Test for PrivateDevices=yes with prefix
 
 [Service]
-ExecStart=sh -x -c '! test -c /dev/kmsg'
-ExecStart=+/bin/sh -x -c 'test -c /dev/kmsg'
+ExecStart=bash -x -c '! test -c /dev/kmsg'
+ExecStart=+bash -x -c 'test -c /dev/kmsg'
 Type=oneshot
 PrivateDevices=yes
diff --git a/test/test-execute/exec-privatedevices-no-capability-mknod.service b/test/test-execute/exec-privatedevices-no-capability-mknod.service
index 811f4ad685..dfdb5932b2 100644
--- a/test/test-execute/exec-privatedevices-no-capability-mknod.service
+++ b/test/test-execute/exec-privatedevices-no-capability-mknod.service
@@ -5,5 +5,5 @@ Description=Test CAP_MKNOD capability for PrivateDevices=no
 [Service]
 PrivateDevices=no
 # sed: remove dropped (cap_xxx-[epi]) and IAB capabilities from the output
-ExecStart=sh -x -c 'capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_mknod'
+ExecStart=bash -x -c 'capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_mknod'
 Type=oneshot
diff --git a/test/test-execute/exec-privatedevices-no-capability-sys-rawio.service b/test/test-execute/exec-privatedevices-no-capability-sys-rawio.service
index 47be622b5f..e756f83b7f 100644
--- a/test/test-execute/exec-privatedevices-no-capability-sys-rawio.service
+++ b/test/test-execute/exec-privatedevices-no-capability-sys-rawio.service
@@ -5,5 +5,5 @@ Description=Test CAP_SYS_RAWIO capability for PrivateDevices=no
 [Service]
 PrivateDevices=no
 # sed: remove dropped (cap_xxx-[epi]) and IAB capabilities from the output
-ExecStart=sh -x -c 'capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_sys_rawio'
+ExecStart=bash -x -c 'capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_sys_rawio'
 Type=oneshot
diff --git a/test/test-execute/exec-privatedevices-no.service b/test/test-execute/exec-privatedevices-no.service
index 5b8a05133b..c2b22b81c2 100644
--- a/test/test-execute/exec-privatedevices-no.service
+++ b/test/test-execute/exec-privatedevices-no.service
@@ -3,6 +3,6 @@
 Description=Test for PrivateDevices=no
 
 [Service]
-ExecStart=sh -x -c 'test -c /dev/kmsg'
+ExecStart=bash -x -c 'test -c /dev/kmsg'
 Type=oneshot
 PrivateDevices=no
diff --git a/test/test-execute/exec-privatedevices-yes-capability-mknod.service b/test/test-execute/exec-privatedevices-yes-capability-mknod.service
index 3d29a9cb05..b3b06af605 100644
--- a/test/test-execute/exec-privatedevices-yes-capability-mknod.service
+++ b/test/test-execute/exec-privatedevices-yes-capability-mknod.service
@@ -5,5 +5,5 @@ Description=Test CAP_MKNOD capability for PrivateDevices=yes
 [Service]
 PrivateDevices=yes
 # sed: remove dropped (cap_xxx-[epi]) and IAB capabilities from the output
-ExecStart=sh -x -c '! capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_mknod'
+ExecStart=bash -x -c '! capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_mknod'
 Type=oneshot
diff --git a/test/test-execute/exec-privatedevices-yes-capability-sys-rawio.service b/test/test-execute/exec-privatedevices-yes-capability-sys-rawio.service
index b1c0617837..4233d477a2 100644
--- a/test/test-execute/exec-privatedevices-yes-capability-sys-rawio.service
+++ b/test/test-execute/exec-privatedevices-yes-capability-sys-rawio.service
@@ -5,5 +5,5 @@ Description=Test CAP_SYS_RAWIO capability for PrivateDevices=yes
 [Service]
 PrivateDevices=yes
 # sed: remove dropped (cap_xxx-[epi]) and IAB capabilities from the output
-ExecStart=sh -x -c '! capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_sys_rawio'
+ExecStart=bash -x -c '! capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_sys_rawio'
 Type=oneshot
diff --git a/test/test-execute/exec-privatedevices-yes-with-group.service b/test/test-execute/exec-privatedevices-yes-with-group.service
index 094ac22724..bdd164348c 100644
--- a/test/test-execute/exec-privatedevices-yes-with-group.service
+++ b/test/test-execute/exec-privatedevices-yes-with-group.service
@@ -8,10 +8,10 @@ Group=daemon
 Type=oneshot
 
 # Check the group applied
-ExecStart=sh -x -c 'test "$$(id -n -g)" = "daemon"'
+ExecStart=bash -x -c 'test "$$(id -n -g)" = "daemon"'
 
 # Check that the namespace applied
-ExecStart=sh -c 'test ! -c /dev/kmsg'
+ExecStart=bash -c 'test ! -c /dev/kmsg'
 
 # Check that the owning group of a node is not daemon (should be the host root)
-ExecStart=sh -x -c 'test ! "$$(stat -c %%G /dev/stderr)" = "daemon"'
+ExecStart=bash -x -c 'test ! "$$(stat -c %%G /dev/stderr)" = "daemon"'
diff --git a/test/test-execute/exec-privatedevices-yes.service b/test/test-execute/exec-privatedevices-yes.service
index 2d32753053..349fd8f974 100644
--- a/test/test-execute/exec-privatedevices-yes.service
+++ b/test/test-execute/exec-privatedevices-yes.service
@@ -3,6 +3,6 @@
 Description=Test for PrivateDevices=yes
 
 [Service]
-ExecStart=sh -c 'test ! -c /dev/kmsg'
+ExecStart=bash -c 'test ! -c /dev/kmsg'
 Type=oneshot
 PrivateDevices=yes
diff --git a/test/test-execute/exec-privatenetwork-yes-privatemounts-no.service b/test/test-execute/exec-privatenetwork-yes-privatemounts-no.service
index c16102d07f..9c7f0a468e 100644
--- a/test/test-execute/exec-privatenetwork-yes-privatemounts-no.service
+++ b/test/test-execute/exec-privatenetwork-yes-privatemounts-no.service
@@ -3,10 +3,10 @@
 Description=Test for PrivateNetwork= without mount namespacing
 
 [Service]
-ExecStart=sh -x -c '! ip link show dummy-test-exec'
-ExecStart=sh -x -c 'test ! -e /proc/sys/net/ipv4/conf/dummy-test-exec'
+ExecStart=bash -x -c '! ip link show dummy-test-exec'
+ExecStart=bash -x -c 'test ! -e /proc/sys/net/ipv4/conf/dummy-test-exec'
 # Without mount namespacing, we can access the dummy-test-exec interface through sysfs
-ExecStart=sh -x -c 'test -d /sys/class/net/dummy-test-exec'
+ExecStart=bash -x -c 'test -d /sys/class/net/dummy-test-exec'
 Type=oneshot
 PrivateNetwork=yes
 PrivateMounts=no
diff --git a/test/test-execute/exec-privatenetwork-yes-privatemounts-yes.service b/test/test-execute/exec-privatenetwork-yes-privatemounts-yes.service
index eb48d6e0c5..2078eff0bd 100644
--- a/test/test-execute/exec-privatenetwork-yes-privatemounts-yes.service
+++ b/test/test-execute/exec-privatenetwork-yes-privatemounts-yes.service
@@ -3,10 +3,10 @@
 Description=Test for PrivateNetwork= with mount namespacing
 
 [Service]
-ExecStart=sh -x -c '! ip link show dummy-test-exec'
-ExecStart=sh -x -c 'test ! -e /proc/sys/net/ipv4/conf/dummy-test-exec'
+ExecStart=bash -x -c '! ip link show dummy-test-exec'
+ExecStart=bash -x -c 'test ! -e /proc/sys/net/ipv4/conf/dummy-test-exec'
 # With mount namespacing, we cannot access the dummy-test-exec interface through sysfs.
-ExecStart=sh -x -c 'test ! -e /sys/class/net/dummy-test-exec'
+ExecStart=bash -x -c 'test ! -e /sys/class/net/dummy-test-exec'
 Type=oneshot
 PrivateNetwork=yes
 # PrivateNetwork=yes implies PrivateMounts=yes
diff --git a/test/test-execute/exec-privatetmp-disabled-by-prefix.service b/test/test-execute/exec-privatetmp-disabled-by-prefix.service
index 9dfcecc02c..6437244520 100644
--- a/test/test-execute/exec-privatetmp-disabled-by-prefix.service
+++ b/test/test-execute/exec-privatetmp-disabled-by-prefix.service
@@ -3,7 +3,7 @@
 Description=Test for PrivateTmp=yes with prefix
 
 [Service]
-ExecStart=sh -x -c 'test ! -f /tmp/test-exec_privatetmp'
-ExecStart=+/bin/sh -x -c 'test -f /tmp/test-exec_privatetmp'
+ExecStart=bash -x -c 'test ! -f /tmp/test-exec_privatetmp'
+ExecStart=+bash -x -c 'test -f /tmp/test-exec_privatetmp'
 Type=oneshot
 PrivateTmp=yes
diff --git a/test/test-execute/exec-privatetmp-disconnected-after-and-requires-for-var.service b/test/test-execute/exec-privatetmp-disconnected-after-and-requires-for-var.service
index 39e49c698a..39594a768e 100644
--- a/test/test-execute/exec-privatetmp-disconnected-after-and-requires-for-var.service
+++ b/test/test-execute/exec-privatetmp-disconnected-after-and-requires-for-var.service
@@ -6,10 +6,10 @@ After=var.mount
 Requires=var.mount
 
 [Service]
-ExecStart=sh -x -c 'test ! -f /tmp/test-exec_privatetmp'
+ExecStart=bash -x -c 'test ! -f /tmp/test-exec_privatetmp'
 ExecStart=touch /tmp/test-exec_privatetmp_disconnected
 ExecStart=touch /var/tmp/test-exec_privatetmp_disconnected
-ExecStart=sh -x -c 'test x$$TMPDIR = x'
+ExecStart=bash -x -c 'test x$$TMPDIR = x'
 Type=oneshot
 ProtectSystem=strict
 PrivateTmp=disconnected
diff --git a/test/test-execute/exec-privatetmp-disconnected-after-and-wants-for-var.service b/test/test-execute/exec-privatetmp-disconnected-after-and-wants-for-var.service
index b11302f5f2..79553df7f1 100644
--- a/test/test-execute/exec-privatetmp-disconnected-after-and-wants-for-var.service
+++ b/test/test-execute/exec-privatetmp-disconnected-after-and-wants-for-var.service
@@ -6,10 +6,10 @@ After=var.mount
 Wants=var.mount
 
 [Service]
-ExecStart=sh -x -c 'test ! -f /tmp/test-exec_privatetmp'
+ExecStart=bash -x -c 'test ! -f /tmp/test-exec_privatetmp'
 ExecStart=touch /tmp/test-exec_privatetmp_disconnected
 ExecStart=touch /var/tmp/test-exec_privatetmp_disconnected
-ExecStart=sh -x -c 'test x$$TMPDIR = x'
+ExecStart=bash -x -c 'test x$$TMPDIR = x'
 Type=oneshot
 ProtectSystem=strict
 PrivateTmp=disconnected
diff --git a/test/test-execute/exec-privatetmp-disconnected-defaultdependencies-no.service b/test/test-execute/exec-privatetmp-disconnected-defaultdependencies-no.service
index 2208b8e1b5..2b8693796a 100644
--- a/test/test-execute/exec-privatetmp-disconnected-defaultdependencies-no.service
+++ b/test/test-execute/exec-privatetmp-disconnected-defaultdependencies-no.service
@@ -4,10 +4,10 @@ Description=Test for PrivateTmp=disconnected with DefaultDependencies=no
 DefaultDependencies=no
 
 [Service]
-ExecStart=sh -x -c 'test ! -f /tmp/test-exec_privatetmp'
+ExecStart=bash -x -c 'test ! -f /tmp/test-exec_privatetmp'
 ExecStart=touch /tmp/test-exec_privatetmp_disconnected
-ExecStart=sh -x -c '(! touch /var/tmp/test-exec_privatetmp_disconnected)'
-ExecStart=sh -x -c 'test $$TMPDIR = /tmp'
+ExecStart=bash -x -c '(! touch /var/tmp/test-exec_privatetmp_disconnected)'
+ExecStart=bash -x -c 'test $$TMPDIR = /tmp'
 Type=oneshot
 ProtectSystem=strict
 PrivateTmp=disconnected
diff --git a/test/test-execute/exec-privatetmp-disconnected-nodefaultdeps-nor-sandboxing.service b/test/test-execute/exec-privatetmp-disconnected-nodefaultdeps-nor-sandboxing.service
index 4bff9d03f1..6fb561d0c9 100644
--- a/test/test-execute/exec-privatetmp-disconnected-nodefaultdeps-nor-sandboxing.service
+++ b/test/test-execute/exec-privatetmp-disconnected-nodefaultdeps-nor-sandboxing.service
@@ -5,6 +5,6 @@ DefaultDependencies=no
 
 [Service]
 ExecStart=+touch /tmp/test-exec_privatetmp_disconnected
-ExecStart=+sh -x -c 'test x$$TMPDIR = x'
+ExecStart=+bash -x -c 'test x$$TMPDIR = x'
 Type=oneshot
 PrivateTmp=disconnected
diff --git a/test/test-execute/exec-privatetmp-disconnected-requires-mounts-for-var.service b/test/test-execute/exec-privatetmp-disconnected-requires-mounts-for-var.service
index 349c137984..58c3ee9499 100644
--- a/test/test-execute/exec-privatetmp-disconnected-requires-mounts-for-var.service
+++ b/test/test-execute/exec-privatetmp-disconnected-requires-mounts-for-var.service
@@ -5,10 +5,10 @@ DefaultDependencies=no
 RequiresMountsFor=/var/
 
 [Service]
-ExecStart=sh -x -c 'test ! -f /tmp/test-exec_privatetmp'
+ExecStart=bash -x -c 'test ! -f /tmp/test-exec_privatetmp'
 ExecStart=touch /tmp/test-exec_privatetmp_disconnected
 ExecStart=touch /var/tmp/test-exec_privatetmp_disconnected
-ExecStart=sh -x -c 'test x$$TMPDIR = x'
+ExecStart=bash -x -c 'test x$$TMPDIR = x'
 Type=oneshot
 ProtectSystem=strict
 PrivateTmp=disconnected
diff --git a/test/test-execute/exec-privatetmp-disconnected-wants-mounts-for-var.service b/test/test-execute/exec-privatetmp-disconnected-wants-mounts-for-var.service
index 09ac3495b8..66337df79a 100644
--- a/test/test-execute/exec-privatetmp-disconnected-wants-mounts-for-var.service
+++ b/test/test-execute/exec-privatetmp-disconnected-wants-mounts-for-var.service
@@ -5,10 +5,10 @@ DefaultDependencies=no
 WantsMountsFor=/var/
 
 [Service]
-ExecStart=sh -x -c 'test ! -f /tmp/test-exec_privatetmp'
+ExecStart=bash -x -c 'test ! -f /tmp/test-exec_privatetmp'
 ExecStart=touch /tmp/test-exec_privatetmp_disconnected
 ExecStart=touch /var/tmp/test-exec_privatetmp_disconnected
-ExecStart=sh -x -c 'test x$$TMPDIR = x'
+ExecStart=bash -x -c 'test x$$TMPDIR = x'
 Type=oneshot
 ProtectSystem=strict
 PrivateTmp=disconnected
diff --git a/test/test-execute/exec-privatetmp-disconnected.service b/test/test-execute/exec-privatetmp-disconnected.service
index fbee568d74..470e4828cf 100644
--- a/test/test-execute/exec-privatetmp-disconnected.service
+++ b/test/test-execute/exec-privatetmp-disconnected.service
@@ -3,10 +3,10 @@
 Description=Test for PrivateTmp=disconnected
 
 [Service]
-ExecStart=sh -x -c 'test ! -f /tmp/test-exec_privatetmp'
+ExecStart=bash -x -c 'test ! -f /tmp/test-exec_privatetmp'
 ExecStart=touch /tmp/test-exec_privatetmp_disconnected
 ExecStart=touch /var/tmp/test-exec_privatetmp_disconnected
-ExecStart=sh -x -c 'test x$$TMPDIR = x'
+ExecStart=bash -x -c 'test x$$TMPDIR = x'
 Type=oneshot
 ProtectSystem=strict
 PrivateTmp=disconnected
diff --git a/test/test-execute/exec-privatetmp-no.service b/test/test-execute/exec-privatetmp-no.service
index 599203abb8..4cf9104a64 100644
--- a/test/test-execute/exec-privatetmp-no.service
+++ b/test/test-execute/exec-privatetmp-no.service
@@ -3,6 +3,6 @@
 Description=Test for PrivateTmp=no
 
 [Service]
-ExecStart=sh -x -c 'test -f /tmp/test-exec_privatetmp'
+ExecStart=bash -x -c 'test -f /tmp/test-exec_privatetmp'
 Type=oneshot
 PrivateTmp=no
diff --git a/test/test-execute/exec-privatetmp-yes.service b/test/test-execute/exec-privatetmp-yes.service
index 5ea52639f0..df6ec3a816 100644
--- a/test/test-execute/exec-privatetmp-yes.service
+++ b/test/test-execute/exec-privatetmp-yes.service
@@ -3,6 +3,6 @@
 Description=Test for PrivateTmp=yes
 
 [Service]
-ExecStart=sh -x -c 'test ! -f /tmp/test-exec_privatetmp'
+ExecStart=bash -x -c 'test ! -f /tmp/test-exec_privatetmp'
 Type=oneshot
 PrivateTmp=yes
diff --git a/test/test-execute/exec-protecthome-tmpfs-vs-protectsystem-strict.service b/test/test-execute/exec-protecthome-tmpfs-vs-protectsystem-strict.service
index c51cacf40d..161acbcb12 100644
--- a/test/test-execute/exec-protecthome-tmpfs-vs-protectsystem-strict.service
+++ b/test/test-execute/exec-protecthome-tmpfs-vs-protectsystem-strict.service
@@ -7,4 +7,4 @@ Description=Test ProtectHome=tmpfs vs ProtectSystem=strict
 ProtectHome=tmpfs
 ProtectSystem=strict
 Type=oneshot
-ExecStart=sh -x -c 'test "$$(stat -fc %%T /home)" = "tmpfs"'
+ExecStart=bash -x -c 'test "$$(stat -fc %%T /home)" = "tmpfs"'
diff --git a/test/test-execute/exec-protectkernellogs-no-capabilities.service b/test/test-execute/exec-protectkernellogs-no-capabilities.service
index be64c58089..1ed350f4b1 100644
--- a/test/test-execute/exec-protectkernellogs-no-capabilities.service
+++ b/test/test-execute/exec-protectkernellogs-no-capabilities.service
@@ -5,5 +5,5 @@ Description=Test CAP_SYSLOG for ProtectKernelLogs=no
 [Service]
 ProtectKernelLogs=no
 # sed: remove dropped (cap_xxx-[epi]) and IAB capabilities from the output
-ExecStart=sh -x -c 'capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_syslog'
+ExecStart=bash -x -c 'capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_syslog'
 Type=oneshot
diff --git a/test/test-execute/exec-protectkernellogs-yes-capabilities.service b/test/test-execute/exec-protectkernellogs-yes-capabilities.service
index 646ff751a7..387a08af68 100644
--- a/test/test-execute/exec-protectkernellogs-yes-capabilities.service
+++ b/test/test-execute/exec-protectkernellogs-yes-capabilities.service
@@ -5,5 +5,5 @@ Description=Test CAP_SYSLOG for ProtectKernelLogs=yes
 [Service]
 ProtectKernelLogs=yes
 # sed: remove dropped (cap_xxx-[epi]) and IAB capabilities from the output
-ExecStart=sh -x -c '! capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_syslog'
+ExecStart=bash -x -c '! capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_syslog'
 Type=oneshot
diff --git a/test/test-execute/exec-protectkernelmodules-no-capabilities.service b/test/test-execute/exec-protectkernelmodules-no-capabilities.service
index cefdb60991..c34a474362 100644
--- a/test/test-execute/exec-protectkernelmodules-no-capabilities.service
+++ b/test/test-execute/exec-protectkernelmodules-no-capabilities.service
@@ -5,5 +5,5 @@ Description=Test CAP_SYS_MODULE ProtectKernelModules=no
 [Service]
 ProtectKernelModules=no
 # sed: remove dropped (cap_xxx-[epi]) and IAB capabilities from the output
-ExecStart=sh -x -c 'capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_sys_module'
+ExecStart=bash -x -c 'capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_sys_module'
 Type=oneshot
diff --git a/test/test-execute/exec-protectkernelmodules-yes-capabilities.service b/test/test-execute/exec-protectkernelmodules-yes-capabilities.service
index 1f327a28ab..cfd0ac1ff7 100644
--- a/test/test-execute/exec-protectkernelmodules-yes-capabilities.service
+++ b/test/test-execute/exec-protectkernelmodules-yes-capabilities.service
@@ -5,5 +5,5 @@ Description=Test CAP_SYS_MODULE for ProtectKernelModules=yes
 [Service]
 ProtectKernelModules=yes
 # sed: remove dropped (cap_xxx-[epi]) and IAB capabilities from the output
-ExecStart=sh -x -c '! capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_sys_module'
+ExecStart=bash -x -c '! capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_sys_module'
 Type=oneshot
diff --git a/test/test-execute/exec-protectkernelmodules-yes-mount-propagation.service b/test/test-execute/exec-protectkernelmodules-yes-mount-propagation.service
index 16399bd206..f134aac8af 100644
--- a/test/test-execute/exec-protectkernelmodules-yes-mount-propagation.service
+++ b/test/test-execute/exec-protectkernelmodules-yes-mount-propagation.service
@@ -4,5 +4,5 @@ Description=Test to make sure that passing ProtectKernelModules=yes disconnect m
 
 [Service]
 ProtectKernelModules=yes
-ExecStart=sh -x -c 'd=$$(mktemp -d -p /tmp); trap "umount \'$$d\' && rmdir \'$$d\'" EXIT; mount -t tmpfs tmpfs "$$d"; grep "$$d" /proc/self/mountinfo && ! grep "$$d" /proc/$${PPID}/mountinfo && ! grep "$$d" /proc/1/mountinfo'
+ExecStart=bash -x -c 'd=$$(mktemp -d -p /tmp); trap "umount \'$$d\' && rmdir \'$$d\'" EXIT; mount -t tmpfs tmpfs "$$d"; grep "$$d" /proc/self/mountinfo && ! grep "$$d" /proc/$${PPID}/mountinfo && ! grep "$$d" /proc/1/mountinfo'
 Type=oneshot
diff --git a/test/test-execute/exec-readonlypaths-mount-propagation.service b/test/test-execute/exec-readonlypaths-mount-propagation.service
index e896bac5fd..f3d1f2e7df 100644
--- a/test/test-execute/exec-readonlypaths-mount-propagation.service
+++ b/test/test-execute/exec-readonlypaths-mount-propagation.service
@@ -4,5 +4,5 @@ Description=Test to make sure that passing ReadOnlyPaths= disconnect mount propa
 
 [Service]
 ReadOnlyPaths=-/i-dont-exist
-ExecStart=sh -x -c 'd=$$(mktemp -d -p /tmp); trap "umount \'$$d\' && rmdir \'$$d\'" EXIT; mount -t tmpfs tmpfs "$$d"; grep "$$d" /proc/self/mountinfo && ! grep "$$d" /proc/$${PPID}/mountinfo && ! grep "$$d" /proc/1/mountinfo'
+ExecStart=bash -x -c 'd=$$(mktemp -d -p /tmp); trap "umount \'$$d\' && rmdir \'$$d\'" EXIT; mount -t tmpfs tmpfs "$$d"; grep "$$d" /proc/self/mountinfo && ! grep "$$d" /proc/$${PPID}/mountinfo && ! grep "$$d" /proc/1/mountinfo'
 Type=oneshot
diff --git a/test/test-execute/exec-readonlypaths-simple.service b/test/test-execute/exec-readonlypaths-simple.service
index 80e6c83bf7..53ba315770 100644
--- a/test/test-execute/exec-readonlypaths-simple.service
+++ b/test/test-execute/exec-readonlypaths-simple.service
@@ -5,8 +5,8 @@ Description=Test for ReadOnlyPaths=
 [Service]
 Type=oneshot
 # This should work, as we explicitly disable the effect of ReadOnlyPaths=
-ExecStart=+/bin/sh -c 'touch /tmp/thisisasimpletest'
+ExecStart=+bash -c 'touch /tmp/thisisasimpletest'
 # This should also work, as we do not disable the effect of ReadOnlyPaths= but invert the exit code
-ExecStart=sh -x -c '! touch /tmp/thisisasimpletest'
-ExecStart=+/bin/sh -c 'rm /tmp/thisisasimpletest'
+ExecStart=bash -x -c '! touch /tmp/thisisasimpletest'
+ExecStart=+bash -c 'rm /tmp/thisisasimpletest'
 ReadOnlyPaths=/tmp
diff --git a/test/test-execute/exec-readonlypaths-with-bindpaths.service b/test/test-execute/exec-readonlypaths-with-bindpaths.service
index 7a183672c7..2879e3d079 100644
--- a/test/test-execute/exec-readonlypaths-with-bindpaths.service
+++ b/test/test-execute/exec-readonlypaths-with-bindpaths.service
@@ -5,5 +5,5 @@ Description=Test for ReadOnlyPaths=
 [Service]
 ReadOnlyPaths=/etc -/i-dont-exist /usr
 BindPaths=/etc:/tmp/etc2
-ExecStart=sh -x -c 'test ! -w /etc && test ! -w /usr && test ! -e /i-dont-exist && test -w /var'
+ExecStart=bash -x -c 'test ! -w /etc && test ! -w /usr && test ! -e /i-dont-exist && test -w /var'
 Type=oneshot
diff --git a/test/test-execute/exec-readonlypaths.service b/test/test-execute/exec-readonlypaths.service
index a0eff8bcec..b1a1e43d5f 100644
--- a/test/test-execute/exec-readonlypaths.service
+++ b/test/test-execute/exec-readonlypaths.service
@@ -5,6 +5,6 @@ Description=Test for ReadOnlyPaths=
 [Service]
 ReadOnlyPaths=/usr /etc /sys /dev -/i-dont-exist
 PrivateDevices=yes
-ExecStart=sh -x -c 'test ! -w /usr && test ! -w /etc && test ! -w /sys && test ! -w /sys/fs/cgroup'
-ExecStart=sh -x -c 'test ! -w /dev && test ! -w /dev/shm && test ! -e /i-dont-exist && test -w /var'
+ExecStart=bash -x -c 'test ! -w /usr && test ! -w /etc && test ! -w /sys && test ! -w /sys/fs/cgroup'
+ExecStart=bash -x -c 'test ! -w /dev && test ! -w /dev/shm && test ! -e /i-dont-exist && test -w /var'
 Type=oneshot
diff --git a/test/test-execute/exec-readwritepaths-mount-propagation.service b/test/test-execute/exec-readwritepaths-mount-propagation.service
index 9b844cf433..e203d13493 100644
--- a/test/test-execute/exec-readwritepaths-mount-propagation.service
+++ b/test/test-execute/exec-readwritepaths-mount-propagation.service
@@ -4,5 +4,5 @@ Description=Test to make sure that passing ReadWritePaths= disconnect mount prop
 
 [Service]
 ReadWritePaths=-/i-dont-exist
-ExecStart=sh -x -c 'd=$$(mktemp -d -p /tmp); trap "umount \'$$d\' && rmdir \'$$d\'" EXIT; mount -t tmpfs tmpfs "$$d"; grep "$$d" /proc/self/mountinfo && ! grep "$$d" /proc/$${PPID}/mountinfo && ! grep "$$d" /proc/1/mountinfo'
+ExecStart=bash -x -c 'd=$$(mktemp -d -p /tmp); trap "umount \'$$d\' && rmdir \'$$d\'" EXIT; mount -t tmpfs tmpfs "$$d"; grep "$$d" /proc/self/mountinfo && ! grep "$$d" /proc/$${PPID}/mountinfo && ! grep "$$d" /proc/1/mountinfo'
 Type=oneshot
diff --git a/test/test-execute/exec-restrictnamespaces-merge-and.service b/test/test-execute/exec-restrictnamespaces-merge-and.service
index fdeb3f140d..ca99dba412 100644
--- a/test/test-execute/exec-restrictnamespaces-merge-and.service
+++ b/test/test-execute/exec-restrictnamespaces-merge-and.service
@@ -6,5 +6,5 @@ Description=Test merging RestrictNamespaces= with AND
 RestrictNamespaces=mnt pid
 RestrictNamespaces=~mnt usr
 ExecStart=unshare -p -f
-ExecStart=sh -c '! unshare -m -u -i -n'
+ExecStart=bash -c '! unshare -m -u -i -n'
 Type=oneshot
diff --git a/test/test-execute/exec-restrictnamespaces-merge-or.service b/test/test-execute/exec-restrictnamespaces-merge-or.service
index fca3718c9d..0e2dff296e 100644
--- a/test/test-execute/exec-restrictnamespaces-merge-or.service
+++ b/test/test-execute/exec-restrictnamespaces-merge-or.service
@@ -6,5 +6,5 @@ Description=Test merging RestrictNamespaces= with OR
 RestrictNamespaces=mnt pid
 RestrictNamespaces=mnt uts
 ExecStart=unshare -m -u -p -f
-ExecStart=sh -c '! unshare -u -i -n'
+ExecStart=bash -c '! unshare -u -i -n'
 Type=oneshot
diff --git a/test/test-execute/exec-runtimedirectory-mode.service b/test/test-execute/exec-runtimedirectory-mode.service
index e75e0d2380..c99ac37516 100644
--- a/test/test-execute/exec-runtimedirectory-mode.service
+++ b/test/test-execute/exec-runtimedirectory-mode.service
@@ -3,8 +3,8 @@
 Description=Test for RuntimeDirectoryMode
 
 [Service]
-ExecStart=sh -x -c 'mode=$$(stat -c %%a %t/test-exec_runtimedirectory-mode); test "$$mode" = "750"'
-ExecStart=sh -x -c 'test "$$RUNTIME_DIRECTORY" = "%t/test-exec_runtimedirectory-mode"'
+ExecStart=bash -x -c 'mode=$$(stat -c %%a %t/test-exec_runtimedirectory-mode); test "$$mode" = "750"'
+ExecStart=bash -x -c 'test "$$RUNTIME_DIRECTORY" = "%t/test-exec_runtimedirectory-mode"'
 Type=oneshot
 RuntimeDirectory=test-exec_runtimedirectory-mode
 RuntimeDirectoryMode=0750
diff --git a/test/test-execute/exec-runtimedirectory-owner-nfsnobody.service b/test/test-execute/exec-runtimedirectory-owner-nfsnobody.service
index 4bc336167c..a08a5fdfc4 100644
--- a/test/test-execute/exec-runtimedirectory-owner-nfsnobody.service
+++ b/test/test-execute/exec-runtimedirectory-owner-nfsnobody.service
@@ -3,7 +3,7 @@
 Description=Test for RuntimeDirectory owner (must not be the default group of the user if Group is set)
 
 [Service]
-ExecStart=sh -x -c 'group=$$(stat -c %%G %t/test-exec_runtimedirectory-owner); test "$$group" = "nfsnobody"'
+ExecStart=bash -x -c 'group=$$(stat -c %%G %t/test-exec_runtimedirectory-owner); test "$$group" = "nfsnobody"'
 Type=oneshot
 Group=nfsnobody
 User=root
diff --git a/test/test-execute/exec-runtimedirectory-owner-nobody.service b/test/test-execute/exec-runtimedirectory-owner-nobody.service
index 5f94bf9cd0..11afe7f57e 100644
--- a/test/test-execute/exec-runtimedirectory-owner-nobody.service
+++ b/test/test-execute/exec-runtimedirectory-owner-nobody.service
@@ -3,7 +3,7 @@
 Description=Test for RuntimeDirectory owner (must not be the default group of the user if Group is set)
 
 [Service]
-ExecStart=sh -x -c 'group=$$(stat -c %%G %t/test-exec_runtimedirectory-owner); test "$$group" = "nobody"'
+ExecStart=bash -x -c 'group=$$(stat -c %%G %t/test-exec_runtimedirectory-owner); test "$$group" = "nobody"'
 Type=oneshot
 Group=nobody
 User=root
diff --git a/test/test-execute/exec-runtimedirectory-owner-nogroup.service b/test/test-execute/exec-runtimedirectory-owner-nogroup.service
index 6d508959f8..134e84ef0b 100644
--- a/test/test-execute/exec-runtimedirectory-owner-nogroup.service
+++ b/test/test-execute/exec-runtimedirectory-owner-nogroup.service
@@ -3,7 +3,7 @@
 Description=Test for RuntimeDirectory owner (must not be the default group of the user if Group is set)
 
 [Service]
-ExecStart=sh -x -c 'group=$$(stat -c %%G %t/test-exec_runtimedirectory-owner); test "$$group" = "nogroup"'
+ExecStart=bash -x -c 'group=$$(stat -c %%G %t/test-exec_runtimedirectory-owner); test "$$group" = "nogroup"'
 Type=oneshot
 Group=nogroup
 User=root
diff --git a/test/test-execute/exec-runtimedirectory-owner.service b/test/test-execute/exec-runtimedirectory-owner.service
index 64d66b302e..38d581b205 100644
--- a/test/test-execute/exec-runtimedirectory-owner.service
+++ b/test/test-execute/exec-runtimedirectory-owner.service
@@ -3,7 +3,7 @@
 Description=Test for RuntimeDirectory owner (must not be the default group of the user if Group is set)
 
 [Service]
-ExecStart=sh -x -c 'group=$$(stat -c %%G %t/test-exec_runtimedirectory-owner-daemon); test "$$group" = "daemon"'
+ExecStart=bash -x -c 'group=$$(stat -c %%G %t/test-exec_runtimedirectory-owner-daemon); test "$$group" = "daemon"'
 Type=oneshot
 Group=daemon
 User=root
diff --git a/test/test-execute/exec-runtimedirectory.service b/test/test-execute/exec-runtimedirectory.service
index f60110a485..1e23d6aec5 100644
--- a/test/test-execute/exec-runtimedirectory.service
+++ b/test/test-execute/exec-runtimedirectory.service
@@ -3,9 +3,9 @@
 Description=Test for RuntimeDirectory
 
 [Service]
-ExecStart=sh -x -c 'test -d %t/test-exec_runtimedirectory'
-ExecStart=sh -x -c 'test -d %t/test-exec_runtimedirectory2/hogehoge'
-ExecStart=sh -x -c 'test "$$RUNTIME_DIRECTORY" = "%t/test-exec_runtimedirectory:%t/test-exec_runtimedirectory2/hogehoge"'
+ExecStart=bash -x -c 'test -d %t/test-exec_runtimedirectory'
+ExecStart=bash -x -c 'test -d %t/test-exec_runtimedirectory2/hogehoge'
+ExecStart=bash -x -c 'test "$$RUNTIME_DIRECTORY" = "%t/test-exec_runtimedirectory:%t/test-exec_runtimedirectory2/hogehoge"'
 Type=oneshot
 RuntimeDirectory=test-exec_runtimedirectory
 RuntimeDirectory=./test-exec_runtimedirectory2///./hogehoge/.
diff --git a/test/test-execute/exec-set-credential.service b/test/test-execute/exec-set-credential.service
index 7f2e87f658..ac33095cdf 100644
--- a/test/test-execute/exec-set-credential.service
+++ b/test/test-execute/exec-set-credential.service
@@ -3,8 +3,8 @@
 Description=Test for SetCredential=
 
 [Service]
-ExecStart=sh -x -c 'test "$$(cat %d/test-execute.set-credential)" = "hoge"'
-ExecStartPost=sh -x -c 'test "$$(cat %d/test-execute.set-credential)" = "hoge"'
+ExecStart=bash -x -c 'test "$$(cat %d/test-execute.set-credential)" = "hoge"'
+ExecStartPost=bash -x -c 'test "$$(cat %d/test-execute.set-credential)" = "hoge"'
 ExecStop=bash -x -c '[[ ! -v CREDENTIALS_DIRECTORY ]]'
 ExecStopPost=bash -x -c '[[ ! -v CREDENTIALS_DIRECTORY ]]'
 Type=oneshot
diff --git a/test/test-execute/exec-specifier-user.service b/test/test-execute/exec-specifier-user.service
index ab565fb4fb..6bbc9c8953 100644
--- a/test/test-execute/exec-specifier-user.service
+++ b/test/test-execute/exec-specifier-user.service
@@ -4,8 +4,8 @@ Description=Test for specifiers
 
 [Service]
 Type=oneshot
-ExecStart=sh -c 'test %t = $$XDG_RUNTIME_DIR'
-ExecStart=sh -c 'test %S = %h/.local/state'
-ExecStart=sh -c 'test %C = %h/.cache'
-ExecStart=sh -c 'test %L = %h/.local/state/log'
-ExecStart=sh -c 'test %E = %h/.config'
+ExecStart=bash -c 'test %t = $$XDG_RUNTIME_DIR'
+ExecStart=bash -c 'test %S = %h/.local/state'
+ExecStart=bash -c 'test %C = %h/.cache'
+ExecStart=bash -c 'test %L = %h/.local/state/log'
+ExecStart=bash -c 'test %E = %h/.config'
diff --git a/test/test-execute/exec-specifier.service b/test/test-execute/exec-specifier.service
index 512f786f83..d4c23b3ace 100644
--- a/test/test-execute/exec-specifier.service
+++ b/test/test-execute/exec-specifier.service
@@ -16,12 +16,12 @@ ExecStart=test %f = /exec/specifier
 ExecStart=test %T = /tmp
 ExecStart=test %V = /var/tmp
 ExecStart=test %d = %t/credentials/%n
-ExecStart=sh -c 'test %u = $$(id -un)'
-ExecStart=sh -c 'test %U = $$(id -u)'
-ExecStart=sh -c 'test %g = $$(id -gn)'
-ExecStart=sh -c 'test %G = $$(id -g)'
+ExecStart=bash -c 'test %u = $$(id -un)'
+ExecStart=bash -c 'test %U = $$(id -u)'
+ExecStart=bash -c 'test %g = $$(id -gn)'
+ExecStart=bash -c 'test %G = $$(id -g)'
 ExecStart=test %h = /root
-ExecStart=sh -c 'test -x %s'
-ExecStart=sh -c 'test %b = $$(cat /proc/sys/kernel/random/boot_id | sed -e 's/-//g')'
-ExecStart=sh -c 'test %H = $$(uname -n)'
-ExecStart=sh -c 'test %v = $$(uname -r)'
+ExecStart=bash -c 'test -x %s'
+ExecStart=bash -c 'test %b = $$(cat /proc/sys/kernel/random/boot_id | sed -e 's/-//g')'
+ExecStart=bash -c 'test %H = $$(uname -n)'
+ExecStart=bash -c 'test %v = $$(uname -r)'
diff --git a/test/test-execute/exec-specifier@.service b/test/test-execute/exec-specifier@.service
index cb9d0a182a..4e630a711e 100644
--- a/test/test-execute/exec-specifier@.service
+++ b/test/test-execute/exec-specifier@.service
@@ -13,12 +13,12 @@ ExecStart=test %I = foo/bar
 ExecStart=test %j = specifier
 ExecStart=test %J = specifier
 ExecStart=test %f = /foo/bar
-ExecStart=sh -c 'test %u = $$(id -un)'
-ExecStart=sh -c 'test %U = $$(id -u)'
-ExecStart=sh -c 'test %g = $$(id -gn)'
-ExecStart=sh -c 'test %G = $$(id -g)'
+ExecStart=bash -c 'test %u = $$(id -un)'
+ExecStart=bash -c 'test %U = $$(id -u)'
+ExecStart=bash -c 'test %g = $$(id -gn)'
+ExecStart=bash -c 'test %G = $$(id -g)'
 ExecStart=test %h = /root
-ExecStart=sh -c 'test -x %s'
-ExecStart=sh -c 'test %b = $$(cat /proc/sys/kernel/random/boot_id | sed -e 's/-//g')'
-ExecStart=sh -c 'test %H = $$(uname -n)'
-ExecStart=sh -c 'test %v = $$(uname -r)'
+ExecStart=bash -c 'test -x %s'
+ExecStart=bash -c 'test %b = $$(cat /proc/sys/kernel/random/boot_id | sed -e 's/-//g')'
+ExecStart=bash -c 'test %H = $$(uname -n)'
+ExecStart=bash -c 'test %v = $$(uname -r)'
diff --git a/test/test-execute/exec-standardinput-data.service b/test/test-execute/exec-standardinput-data.service
index fd56f7e37b..cac9439304 100644
--- a/test/test-execute/exec-standardinput-data.service
+++ b/test/test-execute/exec-standardinput-data.service
@@ -3,7 +3,7 @@
 Description=Test for StandardInputText= and StandardInputData=
 
 [Service]
-ExecStart=sh -x -c 'd=$$(mktemp -d -p /tmp); echo -e "this is a test\nand this is more\nsomething encoded!\nsomething   in multiple lines\nand some more\nand a more bas64 data\nsomething with strange\nembedded\tcharacters\nand something with a exec-stdin-data.service specifier" >$d/text ; cmp $d/text ; rm -rf $d'
+ExecStart=bash -x -c 'd=$$(mktemp -d -p /tmp); echo -e "this is a test\nand this is more\nsomething encoded!\nsomething   in multiple lines\nand some more\nand a more bas64 data\nsomething with strange\nembedded\tcharacters\nand something with a exec-stdin-data.service specifier" >$d/text ; cmp $d/text ; rm -rf $d'
 Type=oneshot
 StandardInput=data
 StandardInputText=this is a test
diff --git a/test/test-execute/exec-standardoutput-append.service b/test/test-execute/exec-standardoutput-append.service
index 45d29ecfdd..563d3eba77 100644
--- a/test/test-execute/exec-standardoutput-append.service
+++ b/test/test-execute/exec-standardoutput-append.service
@@ -3,8 +3,8 @@
 Description=Test for StandardOutput=append:
 
 [Service]
-ExecStartPre=sh -c 'printf "hello\n" >/tmp/test-exec-standardoutput-output'
-ExecStartPre=sh -c 'printf "hello\nhello\n" >/tmp/test-exec-standardoutput-expected'
+ExecStartPre=bash -c 'printf "hello\n" >/tmp/test-exec-standardoutput-output'
+ExecStartPre=bash -c 'printf "hello\nhello\n" >/tmp/test-exec-standardoutput-expected'
 StandardInput=data
 StandardInputText=hello
 StandardOutput=append:/tmp/test-exec-standardoutput-output
diff --git a/test/test-execute/exec-standardoutput-file.service b/test/test-execute/exec-standardoutput-file.service
index 8b689a2494..6d14b359a3 100644
--- a/test/test-execute/exec-standardoutput-file.service
+++ b/test/test-execute/exec-standardoutput-file.service
@@ -3,8 +3,8 @@
 Description=Test for StandardOutput=file:
 
 [Service]
-ExecStartPre=sh -c 'printf "nooo\nhello\n" >/tmp/test-exec-standardoutput-output'
-ExecStartPre=sh -c 'printf "hello\nello\n" >/tmp/test-exec-standardoutput-expected'
+ExecStartPre=bash -c 'printf "nooo\nhello\n" >/tmp/test-exec-standardoutput-output'
+ExecStartPre=bash -c 'printf "hello\nello\n" >/tmp/test-exec-standardoutput-expected'
 StandardInput=data
 StandardInputText=hello
 StandardOutput=file:/tmp/test-exec-standardoutput-output
diff --git a/test/test-execute/exec-standardoutput-truncate.service b/test/test-execute/exec-standardoutput-truncate.service
index 1a86d92d8b..4be9022a38 100644
--- a/test/test-execute/exec-standardoutput-truncate.service
+++ b/test/test-execute/exec-standardoutput-truncate.service
@@ -3,11 +3,11 @@
 Description=Test for StandardOutput=truncate:
 
 [Service]
-ExecStartPre=sh -c 'printf "hello\n" >/tmp/test-exec-standardoutput-output'
-ExecStartPre=sh -c 'printf "hi\n" >/tmp/test-exec-standardoutput-expected'
+ExecStartPre=bash -c 'printf "hello\n" >/tmp/test-exec-standardoutput-output'
+ExecStartPre=bash -c 'printf "hi\n" >/tmp/test-exec-standardoutput-expected'
 StandardInput=data
 StandardInputText=hi
 StandardOutput=truncate:/tmp/test-exec-standardoutput-output
 StandardError=null
-ExecStart=sh -c 'cat && cmp /tmp/test-exec-standardoutput-output /tmp/test-exec-standardoutput-expected'
+ExecStart=bash -c 'cat && cmp /tmp/test-exec-standardoutput-output /tmp/test-exec-standardoutput-expected'
 Type=oneshot
diff --git a/test/test-execute/exec-supplementarygroups-multiple-groups-default-group-user.service b/test/test-execute/exec-supplementarygroups-multiple-groups-default-group-user.service
index 3c90124818..a46a760c0c 100644
--- a/test/test-execute/exec-supplementarygroups-multiple-groups-default-group-user.service
+++ b/test/test-execute/exec-supplementarygroups-multiple-groups-default-group-user.service
@@ -3,9 +3,9 @@
 Description=Test for Supplementary Group with multiple groups without Group and User
 
 [Service]
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "%G" && exit 0; done; exit 1'
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "2" && exit 0; done; exit 1'
-ExecStart=sh -x -c 'test "$$(id -g)" = "%G" && test "$$(id -u)" = "%U"'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "%G" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "2" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'test "$$(id -g)" = "%G" && test "$$(id -u)" = "%U"'
 Type=oneshot
 SupplementaryGroups=1 2
diff --git a/test/test-execute/exec-supplementarygroups-multiple-groups-withgid.service b/test/test-execute/exec-supplementarygroups-multiple-groups-withgid.service
index 0fd1c62052..c597fbce79 100644
--- a/test/test-execute/exec-supplementarygroups-multiple-groups-withgid.service
+++ b/test/test-execute/exec-supplementarygroups-multiple-groups-withgid.service
@@ -3,9 +3,9 @@
 Description=Test for Supplementary Group with multiple groups and Group=1
 
 [Service]
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "2" && exit 0; done; exit 1'
-ExecStart=sh -x -c 'test "$$(id -g)" = "1" && test "$$(id -u)" = "%U"'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "2" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'test "$$(id -g)" = "1" && test "$$(id -u)" = "%U"'
 Type=oneshot
 Group=1
 SupplementaryGroups=1 2
diff --git a/test/test-execute/exec-supplementarygroups-multiple-groups-withuid.service b/test/test-execute/exec-supplementarygroups-multiple-groups-withuid.service
index c430e54685..8149612b8d 100644
--- a/test/test-execute/exec-supplementarygroups-multiple-groups-withuid.service
+++ b/test/test-execute/exec-supplementarygroups-multiple-groups-withuid.service
@@ -3,8 +3,8 @@
 Description=Test for Supplementary Group with multiple groups and Uid=1
 
 [Service]
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "2" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "2" && exit 0; done; exit 1'
 Type=oneshot
 User=1
 SupplementaryGroups=1 2
diff --git a/test/test-execute/exec-supplementarygroups-single-group-user.service b/test/test-execute/exec-supplementarygroups-single-group-user.service
index 20a3561d08..00c29bf24b 100644
--- a/test/test-execute/exec-supplementarygroups-single-group-user.service
+++ b/test/test-execute/exec-supplementarygroups-single-group-user.service
@@ -3,8 +3,8 @@
 Description=Test for Supplementary Group with only one group and uid 1
 
 [Service]
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
-ExecStart=sh -x -c 'test "$$(id -g)" = "1" && test "$$(id -u)" = "1"'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'test "$$(id -g)" = "1" && test "$$(id -u)" = "1"'
 Type=oneshot
 User=1
 Group=1
diff --git a/test/test-execute/exec-supplementarygroups-single-group.service b/test/test-execute/exec-supplementarygroups-single-group.service
index 8c812573e4..99c821bf59 100644
--- a/test/test-execute/exec-supplementarygroups-single-group.service
+++ b/test/test-execute/exec-supplementarygroups-single-group.service
@@ -3,8 +3,8 @@
 Description=Test for Supplementary Group with only one group
 
 [Service]
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
-ExecStart=sh -x -c 'test "$$(id -g)" = "1" && test "$$(id -u)" = "0"'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'test "$$(id -g)" = "1" && test "$$(id -u)" = "0"'
 Type=oneshot
 Group=1
 SupplementaryGroups=1
diff --git a/test/test-execute/exec-supplementarygroups.service b/test/test-execute/exec-supplementarygroups.service
index 0a3d370595..a147cc79f4 100644
--- a/test/test-execute/exec-supplementarygroups.service
+++ b/test/test-execute/exec-supplementarygroups.service
@@ -3,7 +3,7 @@
 Description=Test for Supplementary Group
 
 [Service]
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "%G" && exit 0; done; exit 1'
-ExecStart=sh -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "%G" && exit 0; done; exit 1'
+ExecStart=bash -x -c 'for g in $$(id -G); do test "$$g" = "1" && exit 0; done; exit 1'
 Type=oneshot
 SupplementaryGroups=1
diff --git a/test/test-execute/exec-systemcallfilter-failing.service b/test/test-execute/exec-systemcallfilter-failing.service
index 7437d30108..800e6ede0c 100644
--- a/test/test-execute/exec-systemcallfilter-failing.service
+++ b/test/test-execute/exec-systemcallfilter-failing.service
@@ -3,7 +3,7 @@
 Description=Test for SystemCallFilter
 
 [Service]
-ExecStart=sh -c '/bin/echo "This should not be seen"'
+ExecStart=bash -c '/bin/echo "This should not be seen"'
 Type=oneshot
 LimitCORE=0
 SystemCallFilter=ioperm
diff --git a/test/test-execute/exec-systemcallfilter-failing2.service b/test/test-execute/exec-systemcallfilter-failing2.service
index 92672d1eb1..1738ee93a1 100644
--- a/test/test-execute/exec-systemcallfilter-failing2.service
+++ b/test/test-execute/exec-systemcallfilter-failing2.service
@@ -3,7 +3,7 @@
 Description=Test for SystemCallFilter
 
 [Service]
-ExecStart=sh -c '/bin/echo "This should not be seen"'
+ExecStart=bash -c '/bin/echo "This should not be seen"'
 Type=oneshot
 LimitCORE=0
 SystemCallFilter=~write open execve fexecve execveat exit_group close mmap munmap fstat DONOTEXIST
diff --git a/test/test-execute/exec-systemcallfilter-failing3.service b/test/test-execute/exec-systemcallfilter-failing3.service
index 4e7b81214b..9e27c80400 100644
--- a/test/test-execute/exec-systemcallfilter-failing3.service
+++ b/test/test-execute/exec-systemcallfilter-failing3.service
@@ -3,7 +3,7 @@
 Description=Test for SystemCallFilter
 
 [Service]
-ExecStart=sh -c '/bin/echo "This should not be seen"'
+ExecStart=bash -c '/bin/echo "This should not be seen"'
 Type=oneshot
 LimitCORE=0
 SystemCallArchitectures=native
diff --git a/test/test-execute/exec-systemcallfilter-nonewprivileges-bounding1.service b/test/test-execute/exec-systemcallfilter-nonewprivileges-bounding1.service
index eaa75dfb61..e8ab9b715a 100644
--- a/test/test-execute/exec-systemcallfilter-nonewprivileges-bounding1.service
+++ b/test/test-execute/exec-systemcallfilter-nonewprivileges-bounding1.service
@@ -3,7 +3,7 @@
 Description=Test bounding set is right with SystemCallFilter and non-root user
 
 [Service]
-ExecStart=sh -x -c 'c=$$(capsh --print | grep "Bounding set "); test "$$c" = "Bounding set =cap_net_bind_service"'
+ExecStart=bash -x -c 'c=$$(capsh --print | grep "Bounding set "); test "$$c" = "Bounding set =cap_net_bind_service"'
 Type=oneshot
 User=1
 SystemCallFilter=@system-service
diff --git a/test/test-execute/exec-systemcallfilter-nonewprivileges-bounding2.service b/test/test-execute/exec-systemcallfilter-nonewprivileges-bounding2.service
index fd0e3a259d..a5734fee69 100644
--- a/test/test-execute/exec-systemcallfilter-nonewprivileges-bounding2.service
+++ b/test/test-execute/exec-systemcallfilter-nonewprivileges-bounding2.service
@@ -3,7 +3,7 @@
 Description=Test bounding set is right with SystemCallFilter and non-root user
 
 [Service]
-ExecStart=sh -x -c 'c=$$(capsh --print | grep "Bounding set "); test "$$c" = "Bounding set =cap_setpcap,cap_net_bind_service,cap_sys_admin"'
+ExecStart=bash -x -c 'c=$$(capsh --print | grep "Bounding set "); test "$$c" = "Bounding set =cap_setpcap,cap_net_bind_service,cap_sys_admin"'
 Type=oneshot
 User=1
 SystemCallFilter=@system-service
diff --git a/test/test-execute/exec-systemcallfilter-nonewprivileges-protectclock.service b/test/test-execute/exec-systemcallfilter-nonewprivileges-protectclock.service
index 76b028c82c..64a6b2adbe 100644
--- a/test/test-execute/exec-systemcallfilter-nonewprivileges-protectclock.service
+++ b/test/test-execute/exec-systemcallfilter-nonewprivileges-protectclock.service
@@ -3,7 +3,7 @@
 Description=Test no_new_privs is unset for ProtectClock and non-root user
 
 [Service]
-ExecStart=sh -x -c 'c=$$(cat /proc/self/status | grep "NoNewPrivs:	"); test "$$c" = "NoNewPrivs:	0"'
+ExecStart=bash -x -c 'c=$$(cat /proc/self/status | grep "NoNewPrivs:	"); test "$$c" = "NoNewPrivs:	0"'
 Type=oneshot
 User=1
 ProtectClock=yes
diff --git a/test/test-execute/exec-systemcallfilter-nonewprivileges.service b/test/test-execute/exec-systemcallfilter-nonewprivileges.service
index 2091b71db0..fcae37adc7 100644
--- a/test/test-execute/exec-systemcallfilter-nonewprivileges.service
+++ b/test/test-execute/exec-systemcallfilter-nonewprivileges.service
@@ -3,7 +3,7 @@
 Description=Test no_new_privs is unset for SystemCallFilter and non-root user
 
 [Service]
-ExecStart=sh -x -c 'c=$$(cat /proc/self/status | grep "NoNewPrivs:	"); test "$$c" = "NoNewPrivs:	0"'
+ExecStart=bash -x -c 'c=$$(cat /proc/self/status | grep "NoNewPrivs:	"); test "$$c" = "NoNewPrivs:	0"'
 Type=oneshot
 User=1
 SystemCallFilter=@system-service
diff --git a/test/test-execute/exec-systemcallfilter-not-failing.service b/test/test-execute/exec-systemcallfilter-not-failing.service
index bb2ea55166..ad72b57927 100644
--- a/test/test-execute/exec-systemcallfilter-not-failing.service
+++ b/test/test-execute/exec-systemcallfilter-not-failing.service
@@ -3,7 +3,7 @@
 Description=Test for SystemCallFilter
 
 [Service]
-ExecStart=sh -c 'echo "Foo bar"'
+ExecStart=bash -c 'echo "Foo bar"'
 Type=oneshot
 SystemCallFilter=~read write open execve ioperm
 SystemCallFilter=ioctl
diff --git a/test/test-execute/exec-systemcallfilter-not-failing2.service b/test/test-execute/exec-systemcallfilter-not-failing2.service
index d9f0a3717c..f69998a8e8 100644
--- a/test/test-execute/exec-systemcallfilter-not-failing2.service
+++ b/test/test-execute/exec-systemcallfilter-not-failing2.service
@@ -3,6 +3,6 @@
 Description=Test for SystemCallFilter
 
 [Service]
-ExecStart=sh -c 'echo "Foo bar"'
+ExecStart=bash -c 'echo "Foo bar"'
 Type=oneshot
 SystemCallFilter=
diff --git a/test/test-execute/exec-systemcallfilter-not-failing3.service b/test/test-execute/exec-systemcallfilter-not-failing3.service
index df4e662d40..9e7ef6da4d 100644
--- a/test/test-execute/exec-systemcallfilter-not-failing3.service
+++ b/test/test-execute/exec-systemcallfilter-not-failing3.service
@@ -3,7 +3,7 @@
 Description=Test for SystemCallFilter
 
 [Service]
-ExecStart=sh -c 'echo "Foo bar"'
+ExecStart=bash -c 'echo "Foo bar"'
 Type=oneshot
 SystemCallArchitectures=native
 SystemCallFilter=
diff --git a/test/test-execute/exec-systemcallfilter-system-user-nfsnobody.service b/test/test-execute/exec-systemcallfilter-system-user-nfsnobody.service
index 19122869b1..6e97854068 100644
--- a/test/test-execute/exec-systemcallfilter-system-user-nfsnobody.service
+++ b/test/test-execute/exec-systemcallfilter-system-user-nfsnobody.service
@@ -3,7 +3,7 @@
 Description=Test for SystemCallFilter in system mode with User set
 
 [Service]
-ExecStart=sh -c 'echo "Foo bar"'
+ExecStart=bash -c 'echo "Foo bar"'
 Type=oneshot
 User=nfsnobody
 SystemCallFilter=~read write open execve ioperm
diff --git a/test/test-execute/exec-systemcallfilter-system-user-nobody.service b/test/test-execute/exec-systemcallfilter-system-user-nobody.service
index 0c2ebdd83e..133ff9335a 100644
--- a/test/test-execute/exec-systemcallfilter-system-user-nobody.service
+++ b/test/test-execute/exec-systemcallfilter-system-user-nobody.service
@@ -3,7 +3,7 @@
 Description=Test for SystemCallFilter in system mode with User set
 
 [Service]
-ExecStart=sh -c 'echo "Foo bar"'
+ExecStart=bash -c 'echo "Foo bar"'
 Type=oneshot
 User=nobody
 SystemCallFilter=~read write open execve ioperm
diff --git a/test/test-execute/exec-systemcallfilter-system-user.service b/test/test-execute/exec-systemcallfilter-system-user.service
index 6de39642e9..729ea4c9d8 100644
--- a/test/test-execute/exec-systemcallfilter-system-user.service
+++ b/test/test-execute/exec-systemcallfilter-system-user.service
@@ -3,7 +3,7 @@
 Description=Test for SystemCallFilter in system mode with User set (daemon)
 
 [Service]
-ExecStart=sh -c 'echo "Foo bar"'
+ExecStart=bash -c 'echo "Foo bar"'
 Type=oneshot
 User=daemon
 SystemCallFilter=~read write open execve ioperm
diff --git a/test/test-execute/exec-temporaryfilesystem-options.service b/test/test-execute/exec-temporaryfilesystem-options.service
index b00030131e..a767b95308 100644
--- a/test/test-execute/exec-temporaryfilesystem-options.service
+++ b/test/test-execute/exec-temporaryfilesystem-options.service
@@ -10,8 +10,8 @@ Type=oneshot
 TemporaryFileSystem=/var:ro,mode=0700,nostrictatime
 
 # Check /proc/self/mountinfo
-ExecStart=sh -x -c 'test "$$(awk \'$$5 == "/var" && $$11 !~ /(^|,)mode=700(,|$$)/ { print $$6 }\' /proc/self/mountinfo)" = ""'
+ExecStart=bash -x -c 'test "$$(awk \'$$5 == "/var" && $$11 !~ /(^|,)mode=700(,|$$)/ { print $$6 }\' /proc/self/mountinfo)" = ""'
 
-ExecStart=sh -x -c 'test "$$(awk \'$$5 == "/var" && $$6 !~ /(^|,)ro(,|$$)/ { print $$6 }\' /proc/self/mountinfo)" = ""'
-ExecStart=sh -x -c 'test "$$(awk \'$$5 == "/var" && $$6 !~ /(^|,)nodev(,|$$)/ { print $$6 }\' /proc/self/mountinfo)" = ""'
-ExecStart=sh -x -c 'test "$$(awk \'$$5 == "/var" && $$6 ~ /(^|,)strictatime(,|$$)/ { print $$6 }\' /proc/self/mountinfo)" = ""'
+ExecStart=bash -x -c 'test "$$(awk \'$$5 == "/var" && $$6 !~ /(^|,)ro(,|$$)/ { print $$6 }\' /proc/self/mountinfo)" = ""'
+ExecStart=bash -x -c 'test "$$(awk \'$$5 == "/var" && $$6 !~ /(^|,)nodev(,|$$)/ { print $$6 }\' /proc/self/mountinfo)" = ""'
+ExecStart=bash -x -c 'test "$$(awk \'$$5 == "/var" && $$6 ~ /(^|,)strictatime(,|$$)/ { print $$6 }\' /proc/self/mountinfo)" = ""'
diff --git a/test/test-execute/exec-temporaryfilesystem-ro.service b/test/test-execute/exec-temporaryfilesystem-ro.service
index 0a4b0f2552..6735278252 100644
--- a/test/test-execute/exec-temporaryfilesystem-ro.service
+++ b/test/test-execute/exec-temporaryfilesystem-ro.service
@@ -6,31 +6,31 @@ Description=Test for TemporaryFileSystem with read-only mode
 Type=oneshot
 
 # Check directories exist
-ExecStart=sh -c 'test -d /var/test-exec-temporaryfilesystem/rw && test -d /var/test-exec-temporaryfilesystem/ro'
+ExecStart=bash -c 'test -d /var/test-exec-temporaryfilesystem/rw && test -d /var/test-exec-temporaryfilesystem/ro'
 
 # Check TemporaryFileSystem= are empty
-ExecStart=sh -c 'for i in $$(ls -A /var); do test $$i = test-exec-temporaryfilesystem || false; done'
+ExecStart=bash -c 'for i in $$(ls -A /var); do test $$i = test-exec-temporaryfilesystem || false; done'
 
 # Check default mode
-ExecStart=sh -x -c 'test "$$(stat -c %%a /var)" = "755"'
+ExecStart=bash -x -c 'test "$$(stat -c %%a /var)" = "755"'
 
 # Cannot create a file in /var
-ExecStart=sh -c '! touch /var/hoge'
+ExecStart=bash -c '! touch /var/hoge'
 
 # Create a file in /var/test-exec-temporaryfilesystem/rw
-ExecStart=sh -c 'touch /var/test-exec-temporaryfilesystem/rw/thisisasimpletest-temporaryfilesystem'
+ExecStart=bash -c 'touch /var/test-exec-temporaryfilesystem/rw/thisisasimpletest-temporaryfilesystem'
 
 # Then, the file can be access through /tmp
-ExecStart=sh -c 'test -f /tmp/thisisasimpletest-temporaryfilesystem'
+ExecStart=bash -c 'test -f /tmp/thisisasimpletest-temporaryfilesystem'
 
 # Also, through /var/test-exec-temporaryfilesystem/ro
-ExecStart=sh -c 'test -f /var/test-exec-temporaryfilesystem/ro/thisisasimpletest-temporaryfilesystem'
+ExecStart=bash -c 'test -f /var/test-exec-temporaryfilesystem/ro/thisisasimpletest-temporaryfilesystem'
 
 # The file cannot modify through /var/test-exec-temporaryfilesystem/ro
-ExecStart=sh -c '! touch /var/test-exec-temporaryfilesystem/ro/thisisasimpletest-temporaryfilesystem'
+ExecStart=bash -c '! touch /var/test-exec-temporaryfilesystem/ro/thisisasimpletest-temporaryfilesystem'
 
 # Cleanup
-ExecStart=sh -c 'rm /tmp/thisisasimpletest-temporaryfilesystem'
+ExecStart=bash -c 'rm /tmp/thisisasimpletest-temporaryfilesystem'
 
 TemporaryFileSystem=/var:ro
 BindPaths=/tmp:/var/test-exec-temporaryfilesystem/rw
diff --git a/test/test-execute/exec-temporaryfilesystem-rw.service b/test/test-execute/exec-temporaryfilesystem-rw.service
index ff0aa048d4..48a0b2d613 100644
--- a/test/test-execute/exec-temporaryfilesystem-rw.service
+++ b/test/test-execute/exec-temporaryfilesystem-rw.service
@@ -9,10 +9,10 @@ Type=oneshot
 ExecStart=test -d /var/test-exec-temporaryfilesystem/rw -a -d /var/test-exec-temporaryfilesystem/ro
 
 # Check TemporaryFileSystem= are empty
-ExecStart=sh -c 'for i in $$(ls -A /var); do test $$i = test-exec-temporaryfilesystem || false; done'
+ExecStart=bash -c 'for i in $$(ls -A /var); do test $$i = test-exec-temporaryfilesystem || false; done'
 
 # Check default mode
-ExecStart=sh -x -c 'test "$$(stat -c %%a /var)" = "755"'
+ExecStart=bash -x -c 'test "$$(stat -c %%a /var)" = "755"'
 
 # Create a file in /var
 ExecStart=touch /var/hoge
@@ -27,7 +27,7 @@ ExecStart=test -f /tmp/thisisasimpletest-temporaryfilesystem
 ExecStart=test -f /var/test-exec-temporaryfilesystem/ro/thisisasimpletest-temporaryfilesystem
 
 # The file cannot modify through /var/test-exec-temporaryfilesystem/ro
-ExecStart=sh -c '! touch /var/test-exec-temporaryfilesystem/ro/thisisasimpletest-temporaryfilesystem'
+ExecStart=bash -c '! touch /var/test-exec-temporaryfilesystem/ro/thisisasimpletest-temporaryfilesystem'
 
 # Cleanup
 ExecStart=rm /tmp/thisisasimpletest-temporaryfilesystem
diff --git a/test/test-execute/exec-temporaryfilesystem-usr.service b/test/test-execute/exec-temporaryfilesystem-usr.service
index 455344e114..cae1b8b074 100644
--- a/test/test-execute/exec-temporaryfilesystem-usr.service
+++ b/test/test-execute/exec-temporaryfilesystem-usr.service
@@ -6,11 +6,11 @@ Description=Test for TemporaryFileSystem on /usr
 Type=oneshot
 
 # Check TemporaryFileSystem= are empty
-ExecStart=sh -c 'for i in $$(ls -A /usr); do test $$i = lib -o $$i = lib64 -o $$i = bin -o $$i = sbin || false; done'
+ExecStart=bash -c 'for i in $$(ls -A /usr); do test $$i = lib -o $$i = lib64 -o $$i = bin -o $$i = sbin || false; done'
 
 # Cannot create files under /usr
-ExecStart=sh -c '! touch /usr/hoge'
-ExecStart=sh -c '! touch /usr/bin/hoge'
+ExecStart=bash -c '! touch /usr/hoge'
+ExecStart=bash -c '! touch /usr/bin/hoge'
 
 TemporaryFileSystem=/usr:ro
 BindReadOnlyPaths=-/usr/lib -/usr/lib64 /usr/bin /usr/sbin
diff --git a/test/test-execute/exec-umask-0177.service b/test/test-execute/exec-umask-0177.service
index de9ac5a233..c8835af473 100644
--- a/test/test-execute/exec-umask-0177.service
+++ b/test/test-execute/exec-umask-0177.service
@@ -3,7 +3,7 @@
 Description=Test for UMask
 
 [Service]
-ExecStart=sh -x -c 'rm /tmp/test-exec-umask; touch /tmp/test-exec-umask; mode=$$(stat -c %%a /tmp/test-exec-umask); test "$$mode" = "600"'
+ExecStart=bash -x -c 'rm /tmp/test-exec-umask; touch /tmp/test-exec-umask; mode=$$(stat -c %%a /tmp/test-exec-umask); test "$$mode" = "600"'
 Type=oneshot
 UMask=0177
 PrivateTmp=yes
diff --git a/test/test-execute/exec-umask-default.service b/test/test-execute/exec-umask-default.service
index 6d13c0bfa2..f44f94b2b1 100644
--- a/test/test-execute/exec-umask-default.service
+++ b/test/test-execute/exec-umask-default.service
@@ -3,6 +3,6 @@
 Description=Test for UMask default
 
 [Service]
-ExecStart=sh -x -c 'rm /tmp/test-exec-umask; touch /tmp/test-exec-umask; mode=$$(stat -c %%a /tmp/test-exec-umask); test "$$mode" = "644"'
+ExecStart=bash -x -c 'rm /tmp/test-exec-umask; touch /tmp/test-exec-umask; mode=$$(stat -c %%a /tmp/test-exec-umask); test "$$mode" = "644"'
 Type=oneshot
 PrivateTmp=yes
diff --git a/test/test-execute/exec-unsetenvironment.service b/test/test-execute/exec-unsetenvironment.service
index 9c5e277d05..e64e261072 100644
--- a/test/test-execute/exec-unsetenvironment.service
+++ b/test/test-execute/exec-unsetenvironment.service
@@ -3,7 +3,7 @@
 Description=Test for UnsetEnvironment
 
 [Service]
-ExecStart=sh -x -c 'test "$$FOO" = "bar" && test "$${QUUX-X}" = "X" && test "$$VAR3" = "value3" && test "$${VAR4-X}" = "X" && test "$$VAR5" = "value5" && test "$${X%b-X}" = "X"'
+ExecStart=bash -x -c 'test "$$FOO" = "bar" && test "$${QUUX-X}" = "X" && test "$$VAR3" = "value3" && test "$${VAR4-X}" = "X" && test "$$VAR5" = "value5" && test "$${X%b-X}" = "X"'
 Type=oneshot
 Environment=FOO=bar QUUX=waldo VAR3=value3 VAR4=value4 VAR5=value5 X%b=%U
 UnsetEnvironment=QUUX=waldo VAR3=somethingelse VAR4 X%b=%U
diff --git a/test/test-execute/exec-user-nfsnobody.service b/test/test-execute/exec-user-nfsnobody.service
index 1ce5f08370..aa6a3cca87 100644
--- a/test/test-execute/exec-user-nfsnobody.service
+++ b/test/test-execute/exec-user-nfsnobody.service
@@ -3,6 +3,6 @@
 Description=Test for User
 
 [Service]
-ExecStart=sh -x -c 'test "$$USER" = "nfsnobody"'
+ExecStart=bash -x -c 'test "$$USER" = "nfsnobody"'
 Type=oneshot
 User=nfsnobody
diff --git a/test/test-execute/exec-user-nobody.service b/test/test-execute/exec-user-nobody.service
index 003b873b39..f5f79540bd 100644
--- a/test/test-execute/exec-user-nobody.service
+++ b/test/test-execute/exec-user-nobody.service
@@ -3,6 +3,6 @@
 Description=Test for User
 
 [Service]
-ExecStart=sh -x -c 'test "$$USER" = "nobody"'
+ExecStart=bash -x -c 'test "$$USER" = "nobody"'
 Type=oneshot
 User=nobody
diff --git a/test/test-execute/exec-user.service b/test/test-execute/exec-user.service
index 696c7e5739..c0335b74fa 100644
--- a/test/test-execute/exec-user.service
+++ b/test/test-execute/exec-user.service
@@ -3,6 +3,6 @@
 Description=Test for User (daemon)
 
 [Service]
-ExecStart=sh -x -c 'test "$$USER" = "daemon"'
+ExecStart=bash -x -c 'test "$$USER" = "daemon"'
 Type=oneshot
 User=daemon
diff --git a/test/test-execute/exec-workingdirectory-trailing-dot.service b/test/test-execute/exec-workingdirectory-trailing-dot.service
index 3c4869d858..6fb9fd490f 100644
--- a/test/test-execute/exec-workingdirectory-trailing-dot.service
+++ b/test/test-execute/exec-workingdirectory-trailing-dot.service
@@ -3,6 +3,6 @@
 Description=Test for WorkingDirectory with trailing dot
 
 [Service]
-ExecStart=sh -x -c 'test "$$PWD" = "/tmp/test-exec_workingdirectory"'
+ExecStart=bash -x -c 'test "$$PWD" = "/tmp/test-exec_workingdirectory"'
 Type=oneshot
 WorkingDirectory=/tmp///./test-exec_workingdirectory/.
diff --git a/test/test-execute/exec-workingdirectory.service b/test/test-execute/exec-workingdirectory.service
index 4c40fafcf1..937b957988 100644
--- a/test/test-execute/exec-workingdirectory.service
+++ b/test/test-execute/exec-workingdirectory.service
@@ -3,6 +3,6 @@
 Description=Test for WorkingDirectory
 
 [Service]
-ExecStart=sh -x -c 'test "$$PWD" = "/tmp/test-exec_workingdirectory"'
+ExecStart=bash -x -c 'test "$$PWD" = "/tmp/test-exec_workingdirectory"'
 Type=oneshot
 WorkingDirectory=/tmp/test-exec_workingdirectory
diff --git a/test/test-udev.py b/test/test-udev.py
index 68c48fd790..49695ef739 100755
--- a/test/test-udev.py
+++ b/test/test-udev.py
@@ -596,7 +596,7 @@ RULES = [
             not_exp_links   = ["foo3", "foo4", "foo5", "foo6", "foo7", "foo8"],
         ),
         rules = r"""
-        SUBSYSTEMS=="scsi", PROGRAM=="/bin/sh -c 'echo foo3 foo4 foo5 foo6 foo7 foo8 foo9 | sed  s/foo9/bar9/'", KERNEL=="sda5", SYMLINK+="%c{7}"
+        SUBSYSTEMS=="scsi", PROGRAM=="/bin/bash -c 'echo foo3 foo4 foo5 foo6 foo7 foo8 foo9 | sed  s/foo9/bar9/'", KERNEL=="sda5", SYMLINK+="%c{7}"
         """),
 
     Rules.new(
@@ -618,7 +618,7 @@ RULES = [
             not_exp_links   = ["foo1"],
         ),
         rules = r"""
-        SUBSYSTEMS=="scsi", PROGRAM=="/bin/sh -c 'printf %%s \"foo1 foo2\" | grep \"foo1 foo2\"'", KERNEL=="sda5", SYMLINK+="%c{2}"
+        SUBSYSTEMS=="scsi", PROGRAM=="/bin/bash -c 'printf %%s \"foo1 foo2\" | grep \"foo1 foo2\"'", KERNEL=="sda5", SYMLINK+="%c{2}"
         """),
 
     Rules.new(
@@ -629,7 +629,7 @@ RULES = [
             not_exp_links   = ["foo1"],
         ),
         rules = r"""
-SUBSYSTEMS=="scsi", PROGRAM=="/bin/sh -c \"printf %%s 'foo1 foo2' | grep 'foo1 foo2'\"", KERNEL=="sda5", SYMLINK+="%c{2}"
+SUBSYSTEMS=="scsi", PROGRAM=="/bin/bash -c \"printf %%s 'foo1 foo2' | grep 'foo1 foo2'\"", KERNEL=="sda5", SYMLINK+="%c{2}"
         """),
 
     Rules.new(
@@ -640,7 +640,7 @@ SUBSYSTEMS=="scsi", PROGRAM=="/bin/sh -c \"printf %%s 'foo1 foo2' | grep 'foo1 f
             not_exp_links   = ["foo1", "foo3"],
         ),
         rules = r"""
-        SUBSYSTEMS=="scsi", PROGRAM=="/bin/sh -c 'printf \"%%s %%s\" \"foo1 foo2\" \"foo3\"| grep \"foo1 foo2\"'", KERNEL=="sda5", SYMLINK+="%c{2}"
+        SUBSYSTEMS=="scsi", PROGRAM=="/bin/bash -c 'printf \"%%s %%s\" \"foo1 foo2\" \"foo3\"| grep \"foo1 foo2\"'", KERNEL=="sda5", SYMLINK+="%c{2}"
         """),
 
     Rules.new(
diff --git a/test/units/TEST-03-JOBS.sh b/test/units/TEST-03-JOBS.sh
index 4b8b67bd57..6f7494ef2f 100755
--- a/test/units/TEST-03-JOBS.sh
+++ b/test/units/TEST-03-JOBS.sh
@@ -73,13 +73,13 @@ cat <<EOF >/run/systemd/system/wait2.service
 [Unit]
 Description=Wait for 2 seconds
 [Service]
-ExecStart=sh -ec 'sleep 2'
+ExecStart=bash -ec 'sleep 2'
 EOF
 cat <<EOF >/run/systemd/system/wait5fail.service
 [Unit]
 Description=Wait for 5 seconds and fail
 [Service]
-ExecStart=sh -ec 'sleep 5; false'
+ExecStart=bash -ec 'sleep 5; false'
 EOF
 
 # wait2 succeeds
diff --git a/test/units/TEST-04-JOURNAL.journal.sh b/test/units/TEST-04-JOURNAL.journal.sh
index 5473da1de8..5d2ee3a049 100755
--- a/test/units/TEST-04-JOURNAL.journal.sh
+++ b/test/units/TEST-04-JOURNAL.journal.sh
@@ -93,7 +93,7 @@ grep -vq "^_PID=$PID" /tmp/output
 # https://github.com/systemd/systemd/issues/15654
 ID=$(systemd-id128 new)
 printf "This will\nusually fail\nand be truncated\n" >/tmp/expected
-systemd-cat -t "$ID" sh -c 'env echo -n "This will";echo;env echo -n "usually fail";echo;env echo -n "and be truncated";echo;'
+systemd-cat -t "$ID" bash -c 'env echo -n "This will"; echo; env echo -n "usually fail"; echo; env echo -n "and be truncated"; echo;'
 journalctl --sync
 journalctl -b -o cat -t "$ID" >/tmp/output
 diff /tmp/expected /tmp/output
@@ -221,7 +221,7 @@ journalctl --follow --merge | head -n1 | grep .
 rm -f /tmp/issue-26746-log /tmp/issue-26746-cursor
 ID="$(systemd-id128 new)"
 journalctl -t "$ID" --follow --cursor-file=/tmp/issue-26746-cursor | tee /tmp/issue-26746-log &
-systemd-cat -t "$ID" sh -c 'echo hogehoge'
+systemd-cat -t "$ID" bash -c 'echo hogehoge'
 # shellcheck disable=SC2016
 timeout 10 bash -c 'until [[ -f /tmp/issue-26746-log && "$(cat /tmp/issue-26746-log)" =~ hogehoge ]]; do sleep .5; done'
 pkill -TERM journalctl
diff --git a/test/units/TEST-07-PID1.delegate-namespaces.sh b/test/units/TEST-07-PID1.delegate-namespaces.sh
index 3fd1287fb2..68ade8fc41 100755
--- a/test/units/TEST-07-PID1.delegate-namespaces.sh
+++ b/test/units/TEST-07-PID1.delegate-namespaces.sh
@@ -39,8 +39,8 @@ testcase_pid() {
     # MountAPIVFS=yes always bind mounts child mounts of APIVFS filesystems, which means /proc/sys is always read-only
     # so we can't write to it when running in a container.
     if ! systemd-detect-virt --container; then
-        (! systemd-run -p PrivateUsersEx=self -p PrivatePIDs=yes -p MountAPIVFS=yes --wait --pipe -- sh -c 'echo 5 >/proc/sys/kernel/ns_last_pid')
-        systemd-run -p PrivateUsersEx=self -p PrivatePIDs=yes -p MountAPIVFS=yes -p DelegateNamespaces=pid --wait --pipe -- sh -c 'echo 5 >/proc/sys/kernel/ns_last_pid'
+        (! systemd-run -p PrivateUsersEx=self -p PrivatePIDs=yes -p MountAPIVFS=yes --wait --pipe -- bash -c 'echo 5 >/proc/sys/kernel/ns_last_pid')
+        systemd-run -p PrivateUsersEx=self -p PrivatePIDs=yes -p MountAPIVFS=yes -p DelegateNamespaces=pid --wait --pipe -- bash -c 'echo 5 >/proc/sys/kernel/ns_last_pid'
     fi
 }
 
diff --git a/test/units/TEST-07-PID1.exec-context.sh b/test/units/TEST-07-PID1.exec-context.sh
index 2ec7f018e8..d6255e21cd 100755
--- a/test/units/TEST-07-PID1.exec-context.sh
+++ b/test/units/TEST-07-PID1.exec-context.sh
@@ -356,7 +356,7 @@ systemd-run \
     -p DynamicUser=yes \
     -p EnvironmentFile=-/usr/lib/systemd/systemd-asan-env \
     -p NotifyAccess=all \
-    sh -c 'touch /tmp/a && touch /var/tmp/b && ! test -f /tmp/b && ! test -f /var/tmp/a && systemd-notify --ready && sleep infinity'
+    bash -c 'touch /tmp/a && touch /var/tmp/b && ! test -f /tmp/b && ! test -f /var/tmp/a && systemd-notify --ready && sleep infinity'
 (! ls /tmp/systemd-private-"$(tr -d '-' < /proc/sys/kernel/random/boot_id)"-test-07-dynamic-user-tmp.service-* &>/dev/null)
 (! ls /var/tmp/systemd-private-"$(tr -d '-' < /proc/sys/kernel/random/boot_id)"-test-07-dynamic-user-tmp.service-* &>/dev/null)
 systemctl is-active test-07-dynamic-user-tmp.service
diff --git a/test/units/TEST-07-PID1.exec-timestamps.sh b/test/units/TEST-07-PID1.exec-timestamps.sh
index 0211166ae3..cb602f391c 100755
--- a/test/units/TEST-07-PID1.exec-timestamps.sh
+++ b/test/units/TEST-07-PID1.exec-timestamps.sh
@@ -5,7 +5,7 @@ set -o pipefail
 
 # Check that timestamps of a Type=notify service are consistent
 
-systemd-run --service-type notify --property NotifyAccess=all --unit notify.service --wait sh -c 'systemd-notify --ready; exit 1' || :
+systemd-run --service-type notify --property NotifyAccess=all --unit notify.service --wait bash -c 'systemd-notify --ready; exit 1' || :
 
 start=$(systemctl show --property=ExecMainStartTimestampMonotonic --value notify.service)
 handoff=$(systemctl show --property=ExecMainHandoffTimestampMonotonic --value notify.service)
diff --git a/test/units/TEST-07-PID1.issue-1981.sh b/test/units/TEST-07-PID1.issue-1981.sh
index dcfa9b17b0..33186b7275 100755
--- a/test/units/TEST-07-PID1.issue-1981.sh
+++ b/test/units/TEST-07-PID1.issue-1981.sh
@@ -21,9 +21,9 @@ mkdir -p /run/systemd/system
 cat >/run/systemd/system/my.service <<\EOF
 [Service]
 Type=oneshot
-ExecStartPre=sh -c 'test "$TRIGGER_UNIT" = my.timer'
-ExecStartPre=sh -c 'test -n "$TRIGGER_TIMER_REALTIME_USEC"'
-ExecStartPre=sh -c 'test -n "$TRIGGER_TIMER_MONOTONIC_USEC"'
+ExecStartPre=bash -c 'test "$TRIGGER_UNIT" = my.timer'
+ExecStartPre=bash -c 'test -n "$TRIGGER_TIMER_REALTIME_USEC"'
+ExecStartPre=bash -c 'test -n "$TRIGGER_TIMER_MONOTONIC_USEC"'
 ExecStart=echo Timer runs me
 EOF
 
diff --git a/test/units/TEST-07-PID1.issue-27953.sh b/test/units/TEST-07-PID1.issue-27953.sh
index 8659970a5f..4b2e9507c3 100755
--- a/test/units/TEST-07-PID1.issue-27953.sh
+++ b/test/units/TEST-07-PID1.issue-27953.sh
@@ -7,5 +7,5 @@ set -o pipefail
 # Issue: https://github.com/systemd/systemd/issues/27953
 
 systemctl start issue27953.service
-timeout 10 sh -c 'while systemctl is-active issue27953.service; do sleep .5; done'
+timeout 10 bash -c 'while systemctl is-active issue27953.service; do sleep .5; done'
 [[ "$(systemctl show -P ExitType issue27953.service)" == main ]]
diff --git a/test/units/TEST-07-PID1.issue-30412.sh b/test/units/TEST-07-PID1.issue-30412.sh
index c1cb00e071..afd852ea48 100755
--- a/test/units/TEST-07-PID1.issue-30412.sh
+++ b/test/units/TEST-07-PID1.issue-30412.sh
@@ -28,5 +28,5 @@ systemctl start badbin_assert.socket
 
 socat - ABSTRACT-CONNECT:badbin_assert.socket
 
-timeout 10 sh -c 'while systemctl is-active badbin_assert.service; do sleep .5; done'
+timeout 10 bash -c 'while systemctl is-active badbin_assert.service; do sleep .5; done'
 [[ "$(systemctl show -P ExecMainStatus badbin_assert.service)" == 203 ]]
diff --git a/test/units/TEST-07-PID1.issue-3171.sh b/test/units/TEST-07-PID1.issue-3171.sh
index e1a4b6479f..a4e0b2f1ba 100755
--- a/test/units/TEST-07-PID1.issue-3171.sh
+++ b/test/units/TEST-07-PID1.issue-3171.sh
@@ -24,7 +24,7 @@ cat >/run/systemd/system/issue-3171@.service <<EOF
 Description=Test service
 [Service]
 StandardInput=socket
-ExecStart=sh -x -c cat
+ExecStart=bash -x -c cat
 EOF
 
 systemctl start issue-3171.socket
diff --git a/test/units/TEST-07-PID1.protect-control-groups.sh b/test/units/TEST-07-PID1.protect-control-groups.sh
index 0220e1b692..d58d6265ec 100755
--- a/test/units/TEST-07-PID1.protect-control-groups.sh
+++ b/test/units/TEST-07-PID1.protect-control-groups.sh
@@ -129,11 +129,11 @@ testcase_delegate_subgroup_control() {
             -p PrivateMounts=yes \
             -p Delegate=yes \
             -p DelegateSubgroup=supervisor \
-            -p ExecStartPost='sh -c "cat /proc/self/cgroup; kill $MAINPID"' \
+            -p ExecStartPost='bash -c "cat /proc/self/cgroup; kill $MAINPID"' \
             --unit delegate-subgroup-control \
             --wait \
             --pipe \
-            sh -c 'echo +pids >/sys/fs/cgroup/cgroup.subtree_control; systemd-notify --ready; sleep infinity'
+            bash -c 'echo +pids >/sys/fs/cgroup/cgroup.subtree_control; systemd-notify --ready; sleep infinity'
     )" "0::/"
 }
 
@@ -150,7 +150,7 @@ testcase_delegate_subgroup_pam() {
         --unit delegate-subgroup-pam \
         --wait \
         --pipe \
-        sh -c 'echo +pids >/sys/fs/cgroup/cgroup.subtree_control'
+        bash -c 'echo +pids >/sys/fs/cgroup/cgroup.subtree_control'
 }
 
 run_testcases
diff --git a/test/units/TEST-07-PID1.transient-unit-container.sh b/test/units/TEST-07-PID1.transient-unit-container.sh
index a17f08bd51..03ffa91a70 100755
--- a/test/units/TEST-07-PID1.transient-unit-container.sh
+++ b/test/units/TEST-07-PID1.transient-unit-container.sh
@@ -121,7 +121,7 @@ After=basic.target
 
 [Service]
 Type=oneshot
-ExecStart=sh -c 'echo "$EXPECTED_OUTPUT"  > "$guest_output"'
+ExecStart=bash -c 'echo "$EXPECTED_OUTPUT"  > "$guest_output"'
 ExecStartPost=systemctl --no-block exit 0
 TimeoutStopSec=15s
 
diff --git a/test/units/TEST-13-NSPAWN.machined.sh b/test/units/TEST-13-NSPAWN.machined.sh
index 7ae23558dc..50a8c142db 100755
--- a/test/units/TEST-13-NSPAWN.machined.sh
+++ b/test/units/TEST-13-NSPAWN.machined.sh
@@ -13,7 +13,7 @@ at_exit() {
     set +e
 
     machinectl status long-running &>/dev/null && machinectl kill --signal=KILL long-running
-    mountpoint -q /var/lib/machines && timeout 30 sh -c "until umount /var/lib/machines; do sleep .5; done"
+    mountpoint -q /var/lib/machines && timeout 30 bash -c "until umount /var/lib/machines; do sleep .5; done"
     [[ -n "${NSPAWN_FRAGMENT:-}" ]] && rm -f "/etc/systemd/nspawn/$NSPAWN_FRAGMENT" "/var/lib/machines/$NSPAWN_FRAGMENT"
     rm -f /run/systemd/nspawn/*.nspawn
 }
diff --git a/test/units/TEST-13-NSPAWN.nspawn-oci.sh b/test/units/TEST-13-NSPAWN.nspawn-oci.sh
index bae3e2e085..877482c0f1 100755
--- a/test/units/TEST-13-NSPAWN.nspawn-oci.sh
+++ b/test/units/TEST-13-NSPAWN.nspawn-oci.sh
@@ -305,7 +305,7 @@ cat >"$OCI/config.json" <<EOF
     "hooks" : {
         "prestart" : [
             {
-                "path" : "/bin/sh",
+                "path" : "/bin/bash",
                 "args" : [
                     "-xec",
                     "echo \$PRESTART_FOO >/prestart"
@@ -325,7 +325,7 @@ cat >"$OCI/config.json" <<EOF
         ],
         "poststart" : [
             {
-                "path" : "/bin/sh",
+                "path" : "/bin/bash",
                 "args" : [
                     "touch",
                     "/poststart"
@@ -334,7 +334,7 @@ cat >"$OCI/config.json" <<EOF
         ],
         "poststop" : [
             {
-                "path" : "/bin/sh",
+                "path" : "/bin/bash",
                 "args" : [
                     "touch",
                     "/poststop"
@@ -436,7 +436,7 @@ INVALID_SNIPPETS=(
     '"linux" : { "readonlyPaths" : [ "/foo", 1 ] }'
     '"linux" : { "readonlyPaths" : [ "/foo", "bar" ] }'
     # Invalid hooks
-    '"hooks" : { "prestart" : [ { "path" : "/bin/sh", "timeout" : 0 } ] }'
+    '"hooks" : { "prestart" : [ { "path" : "/bin/bash", "timeout" : 0 } ] }'
     # Invalid annotations
     '"annotations" : { "" : "bar" }'
     '"annotations" : { "foo" : 1 }'
@@ -453,7 +453,7 @@ for snippet in "${INVALID_SNIPPETS[@]}"; do
     $snippet
 }
 EOF
-    (! systemd-nspawn --oci-bundle="$OCI" sh -c 'echo hello')
+    (! systemd-nspawn --oci-bundle="$OCI" bash -c 'echo hello')
 done
 
 # Invalid OCI bundle version
@@ -465,4 +465,4 @@ cat >"$OCI/config.json" <<EOF
     }
 }
 EOF
-(! systemd-nspawn --oci-bundle="$OCI" sh -c 'echo hello')
+(! systemd-nspawn --oci-bundle="$OCI" bash -c 'echo hello')
diff --git a/test/units/TEST-13-NSPAWN.nss-mymachines.sh b/test/units/TEST-13-NSPAWN.nss-mymachines.sh
index 5709ec50d7..a14c53154c 100755
--- a/test/units/TEST-13-NSPAWN.nss-mymachines.sh
+++ b/test/units/TEST-13-NSPAWN.nss-mymachines.sh
@@ -11,7 +11,7 @@ at_exit() {
     set +e
 
     machinectl kill --signal=KILL nss-mymachines-{noip,singleip,manyips}
-    mountpoint -q /var/lib/machines && timeout 30 sh -c "until umount /var/lib/machines; do sleep .5; done"
+    mountpoint -q /var/lib/machines && timeout 30 bash -c "until umount /var/lib/machines; do sleep .5; done"
     rm -f /run/systemd/nspawn/*.nspawn
 }
 
diff --git a/test/units/TEST-16-EXTEND-TIMEOUT.sh b/test/units/TEST-16-EXTEND-TIMEOUT.sh
index 93fc0b78f6..9f5c77e4e8 100755
--- a/test/units/TEST-16-EXTEND-TIMEOUT.sh
+++ b/test/units/TEST-16-EXTEND-TIMEOUT.sh
@@ -70,21 +70,21 @@ runtime_max_sec=5
 systemd-run \
     --property=RuntimeMaxSec=${runtime_max_sec}s \
     -u runtime-max-sec-test-1.service \
-    sh -c "while true; do sleep 1; done"
+    bash -c "while true; do sleep 1; done"
 wait_for_timeout runtime-max-sec-test-1.service $((runtime_max_sec + 2))
 
 systemd-run \
     --property=RuntimeMaxSec=${runtime_max_sec}s \
     --scope \
     -u runtime-max-sec-test-2.scope \
-    sh -c "while true; do sleep 1; done" &
+    bash -c "while true; do sleep 1; done" &
 wait_for_timeout runtime-max-sec-test-2.scope $((runtime_max_sec + 2))
 
 # These ensure that RuntimeMaxSec is honored for scope and service
 # units if the value is changed and then the manager is reloaded.
 systemd-run \
     -u runtime-max-sec-test-3.service \
-    sh -c "while true; do sleep 1; done"
+    bash -c "while true; do sleep 1; done"
 mkdir -p /etc/systemd/system/runtime-max-sec-test-3.service.d/
 cat >/etc/systemd/system/runtime-max-sec-test-3.service.d/override.conf <<EOF
 [Service]
@@ -96,7 +96,7 @@ wait_for_timeout runtime-max-sec-test-3.service $((runtime_max_sec + 2))
 systemd-run \
     --scope \
     -u runtime-max-sec-test-4.scope \
-    sh -c "while true; do sleep 1; done" &
+    bash -c "while true; do sleep 1; done" &
 
 # Wait until the unit is running to avoid race with creating the override.
 until systemctl is-active runtime-max-sec-test-4.scope; do
diff --git a/test/units/TEST-23-UNIT-FILE.ExecStopPost.sh b/test/units/TEST-23-UNIT-FILE.ExecStopPost.sh
index f20af1a141..228550b76b 100755
--- a/test/units/TEST-23-UNIT-FILE.ExecStopPost.sh
+++ b/test/units/TEST-23-UNIT-FILE.ExecStopPost.sh
@@ -17,7 +17,7 @@ systemd-run --unit=exec1.service --wait -p StandardOutput=tty -p StandardError=t
 test -f /run/exec1
 
 (! systemd-run --unit=exec2.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=exec \
-   -p ExecStopPost='touch /run/exec2' sh -c 'sleep 1; false')
+   -p ExecStopPost='touch /run/exec2' bash -c 'sleep 1; false')
 test -f /run/exec2
 
 cat >/tmp/forking1.sh <<EOF
diff --git a/test/units/TEST-23-UNIT-FILE.StandardOutput.sh b/test/units/TEST-23-UNIT-FILE.StandardOutput.sh
index ec01e990be..409882306e 100755
--- a/test/units/TEST-23-UNIT-FILE.StandardOutput.sh
+++ b/test/units/TEST-23-UNIT-FILE.StandardOutput.sh
@@ -9,7 +9,7 @@ systemd-run --wait --unit=TEST-23-UNIT-FILE-standard-output-one \
             -p StandardOutput=file:/tmp/stdout \
             -p StandardError=file:/tmp/stderr \
             -p Type=exec \
-            sh -c 'echo x ; echo y >&2'
+            bash -c 'echo x ; echo y >&2'
 cmp /tmp/stdout <<EOF
 x
 EOF
@@ -21,7 +21,7 @@ systemd-run --wait --unit=TEST-23-UNIT-FILE-standard-output-two \
             -p StandardOutput=file:/tmp/stdout \
             -p StandardError=file:/tmp/stderr \
             -p Type=exec \
-            sh -c 'echo z ; echo a >&2'
+            bash -c 'echo z ; echo a >&2'
 cmp /tmp/stdout <<EOF
 z
 EOF
@@ -33,7 +33,7 @@ systemd-run --wait --unit=TEST-23-UNIT-FILE-standard-output-three \
             -p StandardOutput=append:/tmp/stdout \
             -p StandardError=append:/tmp/stderr \
             -p Type=exec \
-            sh -c 'echo b ; echo c >&2'
+            bash -c 'echo b ; echo c >&2'
 cmp /tmp/stdout <<EOF
 z
 b
@@ -47,7 +47,7 @@ systemd-run --wait --unit=TEST-23-UNIT-FILE-standard-output-four \
             -p StandardOutput=truncate:/tmp/stdout \
             -p StandardError=truncate:/tmp/stderr \
             -p Type=exec \
-            sh -c 'echo a ; echo b >&2'
+            bash -c 'echo a ; echo b >&2'
 cmp /tmp/stdout <<EOF
 a
 EOF
diff --git a/test/units/TEST-23-UNIT-FILE.statedir.sh b/test/units/TEST-23-UNIT-FILE.statedir.sh
index f2b3adb0d2..64de27f55c 100755
--- a/test/units/TEST-23-UNIT-FILE.statedir.sh
+++ b/test/units/TEST-23-UNIT-FILE.statedir.sh
@@ -56,8 +56,8 @@ test "$(readlink "$HOME"/.local/state/foo)" = ../../.config/foo
 # Check that this will work safely a second time
 systemd-run --user -p StateDirectory=foo -p ConfigurationDirectory=foo --wait true
 
-( ! systemd-run --user -p StateDirectory=foo::ro --wait sh -c "echo foo > $HOME/.local/state/foo/baz")
-( ! systemd-run --user -p StateDirectory=foo:bar:ro --wait sh -c "echo foo > $HOME/.local/state/foo/baz")
+( ! systemd-run --user -p StateDirectory=foo::ro --wait bash -c "echo foo > $HOME/.local/state/foo/baz")
+( ! systemd-run --user -p StateDirectory=foo:bar:ro --wait bash -c "echo foo > $HOME/.local/state/foo/baz")
 ( ! test -f "$HOME"/.local/state/foo/baz)
 test -L "$HOME"/.local/state/bar
 
diff --git a/test/units/TEST-34-DYNAMICUSERMIGRATE.sh b/test/units/TEST-34-DYNAMICUSERMIGRATE.sh
index e89c012dd3..601e44098d 100755
--- a/test/units/TEST-34-DYNAMICUSERMIGRATE.sh
+++ b/test/units/TEST-34-DYNAMICUSERMIGRATE.sh
@@ -23,7 +23,7 @@ test_directory() {
     (! systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"=zzz test -f "${path}"/zzz/test-missing)
     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"="www::ro www:ro:ro" test -d "${path}"/www
     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"="www::ro www:ro:ro" test -L "${path}"/ro
-    (! systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"="www::ro www:ro:ro" sh -c "echo foo > ${path}/www/test-missing")
+    (! systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"="www::ro www:ro:ro" bash -c "echo foo > ${path}/www/test-missing")
 
     test -d "${path}"/zzz
     test ! -L "${path}"/zzz
@@ -50,7 +50,7 @@ test_directory() {
     (! systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=1 -p "${directory}"=zzz test -f "${path}"/zzz/test-missing)
     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=1 -p "${directory}"="www::ro www:ro:ro" test -d "${path}"/www
     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=1 -p "${directory}"="www::ro www:ro:ro" test -L "${path}"/ro
-    (! systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=1 -p "${directory}"="www::ro www:ro:ro" sh -c "echo foo > ${path}/www/test-missing")
+    (! systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=1 -p "${directory}"="www::ro www:ro:ro" bash -c "echo foo > ${path}/www/test-missing")
 
     test -L "${path}"/zzz
     test -d "${path}"/private/zzz
@@ -76,7 +76,7 @@ test_directory() {
     (! systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"=zzz test -f "${path}"/zzz/test-missing)
     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"="www::ro www:ro:ro" test -d "${path}"/www
     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"="www::ro www:ro:ro" test -L "${path}"/ro
-    (! systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"="www::ro www:ro:ro" sh -c "echo foo > ${path}/www/test-missing")
+    (! systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"="www::ro www:ro:ro" bash -c "echo foo > ${path}/www/test-missing")
 
     test -d "${path}"/zzz
     test ! -L "${path}"/zzz
@@ -106,7 +106,7 @@ ExecStart=test -f ${path}/x:yz/test
 ExecStart=test -f ${path}/zzz/test
 ExecStart=test -d ${path}/www
 ExecStart=test -L ${path}/ro
-ExecStart=sh -c "! test -w ${path}/www"
+ExecStart=bash -c "! test -w ${path}/www"
 EOF
     systemctl daemon-reload
     systemctl start --wait testservice-34.service
diff --git a/test/units/TEST-43-PRIVATEUSER-UNPRIV.sh b/test/units/TEST-43-PRIVATEUSER-UNPRIV.sh
index b28df65fe5..b15d62d4f9 100755
--- a/test/units/TEST-43-PRIVATEUSER-UNPRIV.sh
+++ b/test/units/TEST-43-PRIVATEUSER-UNPRIV.sh
@@ -84,12 +84,12 @@ runas testuser systemd-run --wait --user --unit=test-caps \
 
 runas testuser systemd-run --wait --user --unit=test-devices \
     -p PrivateDevices=yes -p PrivateIPC=yes \
-    sh -c "ls -1 /dev/ | wc -l | grep -q -F 18"
+    bash -c "ls -1 /dev/ | wc -l | grep -q -F 18"
 
 # Same check as test/test-execute/exec-privatenetwork-yes.service
 runas testuser systemd-run --wait --user --unit=test-network \
     -p PrivateNetwork=yes \
-    sh -x -c '! ip link | grep -E "^[0-9]+: " | grep -Ev ": (lo|(erspan|gre|gretap|ip_vti|ip6_vti|ip6gre|ip6tnl|sit|tunl)0@.*):"'
+    bash -x -c '! ip link | grep -E "^[0-9]+: " | grep -Ev ": (lo|(erspan|gre|gretap|ip_vti|ip6_vti|ip6gre|ip6tnl|sit|tunl)0@.*):"'
 
 (! runas testuser systemd-run --wait --user --unit=test-hostname \
     -p ProtectHostname=yes \
@@ -101,11 +101,11 @@ runas testuser systemd-run --wait --user --unit=test-network \
 
 (! runas testuser systemd-run --wait --user --unit=test-kernel-tunable \
     -p ProtectKernelTunables=yes \
-    sh -c "echo 0 >/proc/sys/user/max_user_namespaces")
+    bash -c "echo 0 >/proc/sys/user/max_user_namespaces")
 
 (! runas testuser systemd-run --wait --user --unit=test-kernel-mod \
     -p ProtectKernelModules=yes \
-    sh -c "modprobe -r overlay && modprobe overlay")
+    bash -c "modprobe -r overlay && modprobe overlay")
 
 if sysctl kernel.dmesg_restrict=0; then
     (! runas testuser systemd-run --wait --user --unit=test-kernel-log \
diff --git a/test/units/TEST-46-HOMED.sh b/test/units/TEST-46-HOMED.sh
index 15a53b18f7..8eee967d7c 100755
--- a/test/units/TEST-46-HOMED.sh
+++ b/test/units/TEST-46-HOMED.sh
@@ -687,20 +687,20 @@ run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest cp -a
 run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest ln -s /home/srub Areas/srub
 run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest ln -s /root Areas/root
 
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest sh -c 'echo $HOME')" = "/home/subareatest"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest sh -c 'echo x$XDG_AREA')" = "x"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest sh -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb sh -c 'echo $HOME')" = "/home/subareatest/Areas/furb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb sh -c 'echo $XDG_AREA')" = "furb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb sh -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/furb"
+test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest bash -c 'echo $HOME')" = "/home/subareatest"
+test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest bash -c 'echo x$XDG_AREA')" = "x"
+test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)"
+test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $HOME')" = "/home/subareatest/Areas/furb"
+test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $XDG_AREA')" = "furb"
+test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/furb"
 
 PASSWORD=quux homectl update subareatest --default-area=molb
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest sh -c 'echo $HOME')" = "/home/subareatest/Areas/molb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest sh -c 'echo $XDG_AREA')" = "molb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest sh -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/molb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb sh -c 'echo $HOME')" = "/home/subareatest/Areas/furb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb sh -c 'echo $XDG_AREA')" = "furb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb sh -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/furb"
+test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest bash -c 'echo $HOME')" = "/home/subareatest/Areas/molb"
+test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest bash -c 'echo $XDG_AREA')" = "molb"
+test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/molb"
+test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $HOME')" = "/home/subareatest/Areas/furb"
+test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $XDG_AREA')" = "furb"
+test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/furb"
 
 # Install a PK rule that allows 'subareatest' user to invoke run0 without password, just for testing
 cat >/usr/share/polkit-1/rules.d/subareatest.rules <<'EOF'
@@ -713,24 +713,24 @@ polkit.addRule(function(action, subject) {
 EOF
 
 # Test "recursive" operation
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb sh -c 'echo $HOME')" = "/home/subareatest/Areas/molb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb sh -c 'echo $XDG_AREA')" = "molb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb sh -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/molb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb sh -c 'echo $HOME')" = "/home/subareatest/Areas/furb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb sh -c 'echo $XDG_AREA')" = "furb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb sh -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/furb"
+test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb bash -c 'echo $HOME')" = "/home/subareatest/Areas/molb"
+test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb bash -c 'echo $XDG_AREA')" = "molb"
+test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/molb"
+test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $HOME')" = "/home/subareatest/Areas/furb"
+test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $XDG_AREA')" = "furb"
+test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/furb"
 
 # Test symlinked area
 mkdir -p /home/srub
 chown subareatest:subareatest /home/srub
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=srub sh -c 'echo $HOME')" = "/home/srub"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=srub sh -c 'echo $XDG_AREA')" = "srub"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=srub sh -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/srub"
+test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=srub bash -c 'echo $HOME')" = "/home/srub"
+test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=srub bash -c 'echo $XDG_AREA')" = "srub"
+test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=srub bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/srub"
 
 # Verify that login into an area not owned by target user will be redirected to main area
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=root sh -c 'echo $HOME')" = "/home/subareatest"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=root sh -c 'echo x$XDG_AREA')" = "x"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=root sh -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)"
+test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=root bash -c 'echo $HOME')" = "/home/subareatest"
+test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=root bash -c 'echo x$XDG_AREA')" = "x"
+test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=root bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)"
 
 systemctl stop user@"$(id -u subareatest)".service
 
diff --git a/test/units/TEST-50-DISSECT.dissect.sh b/test/units/TEST-50-DISSECT.dissect.sh
index 6ac4263dff..bf45489545 100755
--- a/test/units/TEST-50-DISSECT.dissect.sh
+++ b/test/units/TEST-50-DISSECT.dissect.sh
@@ -363,7 +363,7 @@ Type=notify
 RemainAfterExit=yes
 MountAPIVFS=yes
 PrivateTmp=yes
-ExecStart=sh -c ' \\
+ExecStart=bash -c ' \\
     systemd-notify --ready; \\
     while [ ! -f /tmp/img/usr/lib/os-release ] || ! grep -q -F MARKER /tmp/img/usr/lib/os-release; do \\
         sleep 0.1; \\
diff --git a/test/units/TEST-50-DISSECT.mountfsd.sh b/test/units/TEST-50-DISSECT.mountfsd.sh
index a70cf6df0f..5985cbdb79 100755
--- a/test/units/TEST-50-DISSECT.mountfsd.sh
+++ b/test/units/TEST-50-DISSECT.mountfsd.sh
@@ -76,7 +76,7 @@ if [ "$VERITY_SIG_SUPPORTED" -eq 1 ]; then
     systemd-run -M testuser@ --user --pipe --wait \
         --property RootImage="$MINIMAL_IMAGE.raw" \
         --property ExtensionImages=/tmp/app0.raw \
-        sh -c "test -e \"/dev/mapper/${MINIMAL_IMAGE_ROOTHASH}-verity\" && test -e \"/dev/mapper/$(</tmp/app0.roothash)-verity\""
+        bash -c "test -e \"/dev/mapper/${MINIMAL_IMAGE_ROOTHASH}-verity\" && test -e \"/dev/mapper/$(</tmp/app0.roothash)-verity\""
 
     # Without a signature this should not work, as mountfsd should reject it, even if we explicitly ask to
     # trust it
@@ -84,12 +84,12 @@ if [ "$VERITY_SIG_SUPPORTED" -eq 1 ]; then
     (! systemd-run -M testuser@ --user --pipe --wait \
         --property RootImage="$MINIMAL_IMAGE.raw" \
         --property ExtensionImages=/tmp/app0.raw \
-        sh -c "test -e \"/dev/mapper/${MINIMAL_IMAGE_ROOTHASH}-verity\" && test -e \"/dev/mapper/$(</tmp/app0.roothash)-verity\"")
+        bash -c "test -e \"/dev/mapper/${MINIMAL_IMAGE_ROOTHASH}-verity\" && test -e \"/dev/mapper/$(</tmp/app0.roothash)-verity\"")
     (! systemd-run -M testuser@ --user --pipe --wait \
         --property RootImage="$MINIMAL_IMAGE.raw" \
         --property ExtensionImages=/tmp/app0.raw \
         --property ExtensionImagePolicy=root=verity+signed+absent:usr=verity+signed+absent \
-        sh -c "test -e \"/dev/mapper/${MINIMAL_IMAGE_ROOTHASH}-verity\" && test -e \"/dev/mapper/$(</tmp/app0.roothash)-verity\"")
+        bash -c "test -e \"/dev/mapper/${MINIMAL_IMAGE_ROOTHASH}-verity\" && test -e \"/dev/mapper/$(</tmp/app0.roothash)-verity\"")
     mv /tmp/app0.roothash.p7s.bak /tmp/app0.roothash.p7s
 fi
 
diff --git a/test/units/TEST-65-ANALYZE.sh b/test/units/TEST-65-ANALYZE.sh
index f368d21653..929796751d 100755
--- a/test/units/TEST-65-ANALYZE.sh
+++ b/test/units/TEST-65-ANALYZE.sh
@@ -1146,7 +1146,7 @@ Description=Test unit for systemd-analyze unit-shell
 [Service]
 Type=notify
 NotifyAccess=all
-ExecStart=sh -c "echo 'Hello from test unit' >/tmp/testfile; systemd-notify --ready; sleep infinity"
+ExecStart=bash -c "echo 'Hello from test unit' >/tmp/testfile; systemd-notify --ready; sleep infinity"
 PrivateTmp=disconnected
 EOF
 # Start the service
diff --git a/test/units/autorelabel.service b/test/units/autorelabel.service
index f0f4db397d..1d94cb0a1c 100644
--- a/test/units/autorelabel.service
+++ b/test/units/autorelabel.service
@@ -22,7 +22,7 @@ ConditionPathExists=|/.autorelabel
 SuccessAction=reboot
 
 [Service]
-ExecStart=sh -xec 'echo 0 >/sys/fs/selinux/enforce; fixfiles -f -F relabel; rm /.autorelabel;'
+ExecStart=bash -xec 'echo 0 >/sys/fs/selinux/enforce; fixfiles -f -F relabel; rm /.autorelabel;'
 Type=oneshot
 TimeoutSec=infinity
 

From 3672e24e75c6c26ae93da535e516f15d1267bde3 Mon Sep 17 00:00:00 2001
From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Mon, 1 Dec 2025 09:24:57 +0900
Subject: [PATCH 03/15] test-seccomp: do not fail when already
 MemoryDenyWriteExecute= is enabled

---
 src/test/test-seccomp.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/test/test-seccomp.c b/src/test/test-seccomp.c
index 0a34584cff..e81355abdd 100644
--- a/src/test/test-seccomp.c
+++ b/src/test/test-seccomp.c
@@ -611,7 +611,10 @@ TEST(memory_deny_write_execute_shmat) {
                 void *p;
 
                 p = shmat(shmid, NULL, 0);
-                assert_se(p != MAP_FAILED);
+                if (p == MAP_FAILED) {
+                        log_tests_skipped_errno(errno, "shmat() is already disabled");
+                        _exit(EXIT_SUCCESS);
+                }
                 assert_se(shmdt(p) == 0);
 
                 p = shmat(shmid, NULL, SHM_EXEC);

From 45014d97dde3f1497ce8141f15f6a98cd46edef2 Mon Sep 17 00:00:00 2001
From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Wed, 26 Nov 2025 03:13:15 +0900
Subject: [PATCH 04/15] TEST-13-NSPAWN: the host kernel may not support
 /proc/kcore

---
 test/units/TEST-13-NSPAWN.nspawn-oci.sh | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/test/units/TEST-13-NSPAWN.nspawn-oci.sh b/test/units/TEST-13-NSPAWN.nspawn-oci.sh
index 877482c0f1..1fd2a5ad76 100755
--- a/test/units/TEST-13-NSPAWN.nspawn-oci.sh
+++ b/test/units/TEST-13-NSPAWN.nspawn-oci.sh
@@ -39,6 +39,12 @@ create_dummy_container "$OCI/rootfs"
 mkdir -p "$OCI/rootfs/opt/var"
 mkdir -p "$OCI/rootfs/opt/readonly"
 
+if [[ -e /proc/kcore ]]; then
+    HAVE_PROC_KCORE=1
+else
+    HAVE_PROC_KCORE=0
+fi
+
 # Let's start with a simple config
 cat >"$OCI/config.json" <<EOF
 {
@@ -376,8 +382,12 @@ test -b "$DEV"
 [[ "\$(stat -c '%t:%T' "$DEV")" == 4:2 ]]
 
 # Linux - maskedPaths
-test -e /proc/kcore
-cat /proc/kcore && exit 1
+if [[ "$HAVE_PROC_KCORE" == 1 ]]; then
+    test -e /proc/kcore
+    cat /proc/kcore && exit 1
+else
+    test ! -e /proc/kcore
+fi
 test ! -e /root/nonexistent
 
 # Linux - readonlyPaths

From 4722619c4b7561ff2ea11be4876bf13d5b53f1a6 Mon Sep 17 00:00:00 2001
From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Wed, 26 Nov 2025 23:51:29 +0900
Subject: [PATCH 05/15] TEST-35-LOGIN: show remaining sessions in
 cleanup_session()

Otherwise it is hard to see which session is still active.
---
 test/units/TEST-35-LOGIN.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/test/units/TEST-35-LOGIN.sh b/test/units/TEST-35-LOGIN.sh
index e536e0ae5c..4c5e9a51bb 100755
--- a/test/units/TEST-35-LOGIN.sh
+++ b/test/units/TEST-35-LOGIN.sh
@@ -268,6 +268,7 @@ cleanup_session() (
     loginctl terminate-user logind-test-user
 
     if ! timeout 30 bash -c "while loginctl --no-legend | grep -q logind-test-user; do sleep 1; done"; then
+        loginctl
         echo "WARNING: session for logind-test-user still active, ignoring."
     fi
 

From ae2ccf9d6e8555600c78e3038d79fc3a6021e5ce Mon Sep 17 00:00:00 2001
From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Wed, 26 Nov 2025 22:44:14 +0900
Subject: [PATCH 06/15] TEST-35-LOGIN: fix bus path when the session does not
 have corresponding audit session

If there is no corresponding audit session, then the session ID is
prefixed with 'c', and in that case the session ID should be used as is
in bus path.
---
 test/units/TEST-35-LOGIN.sh | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/test/units/TEST-35-LOGIN.sh b/test/units/TEST-35-LOGIN.sh
index 4c5e9a51bb..c3dd11afa6 100755
--- a/test/units/TEST-35-LOGIN.sh
+++ b/test/units/TEST-35-LOGIN.sh
@@ -25,6 +25,17 @@ setup_test_user() {
     trap cleanup_test_user EXIT
 }
 
+session_bus_path() {
+    local session
+
+    session=$(loginctl list-sessions --no-legend | grep -v manager | awk '$3 == "logind-test-user" { print $1 }')
+    if ! [[ "${session?}" =~ c[0-9]* ]]; then
+        # When numeric, bus path is prefixed with '_3'
+        session="_3${session}"
+    fi
+    echo "/org/freedesktop/login1/session/${session}"
+}
+
 test_write_dropin() {
     systemctl edit --runtime --stdin systemd-logind.service --drop-in=debug.conf <<EOF
 [Service]
@@ -557,12 +568,11 @@ testcase_session_properties() {
     trap cleanup_session RETURN
     create_session
 
-    s=$(loginctl list-sessions --no-legend | grep -v manager | awk '$3 == "logind-test-user" { print $1 }')
-    /usr/lib/systemd/tests/unit-tests/manual/test-session-properties "/org/freedesktop/login1/session/_3${s?}" /dev/tty2
+    /usr/lib/systemd/tests/unit-tests/manual/test-session-properties "$(session_bus_path)" /dev/tty2
 }
 
 testcase_list_users_sessions_seats() {
-    local session seat
+    local path seat
 
     if [[ ! -c /dev/tty2 ]]; then
         echo "/dev/tty2 does not exist, skipping test ${FUNCNAME[0]}."
@@ -575,11 +585,11 @@ testcase_list_users_sessions_seats() {
     # Activate the session
     loginctl activate "$(loginctl --no-legend | grep -v manager | awk '$3 == "logind-test-user" { print $1 }')"
 
-    session=$(loginctl list-sessions --no-legend | grep -v manager | awk '$3 == "logind-test-user" { print $1 }')
+    path=$(session_bus_path)
     : check that we got a valid session id
-    busctl get-property org.freedesktop.login1 "/org/freedesktop/login1/session/_3${session?}" org.freedesktop.login1.Session Id
-    busctl get-property org.freedesktop.login1 "/org/freedesktop/login1/session/_3${session?}" org.freedesktop.login1.Session CanIdle
-    busctl get-property org.freedesktop.login1 "/org/freedesktop/login1/session/_3${session?}" org.freedesktop.login1.Session CanLock
+    busctl get-property org.freedesktop.login1 "$path" org.freedesktop.login1.Session Id
+    busctl get-property org.freedesktop.login1 "$path" org.freedesktop.login1.Session CanIdle
+    busctl get-property org.freedesktop.login1 "$path" org.freedesktop.login1.Session CanLock
     assert_eq "$(loginctl list-sessions --no-legend | grep -v manager | awk '$3 == "logind-test-user" { print $2 }')" "$(id -ru logind-test-user)"
     seat=$(loginctl list-sessions --no-legend | grep -v manager | awk '$3 == "logind-test-user" { print $4 }')
     assert_eq "$(loginctl list-sessions --no-legend | grep -v manager | awk '$3 == "logind-test-user" { print $6 }')" user

From f5f96d44fdec7c9ea74d4e598d75593ee35365c3 Mon Sep 17 00:00:00 2001
From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Tue, 25 Nov 2025 09:50:36 +0900
Subject: [PATCH 07/15] TEST-46-HOMED: split into small testcases

This also replace long IDENTITY= line with pretty json string.
---
 test/units/TEST-46-HOMED.sh | 1247 ++++++++++++++++++-----------------
 1 file changed, 655 insertions(+), 592 deletions(-)

diff --git a/test/units/TEST-46-HOMED.sh b/test/units/TEST-46-HOMED.sh
index 8eee967d7c..b18e05f153 100755
--- a/test/units/TEST-46-HOMED.sh
+++ b/test/units/TEST-46-HOMED.sh
@@ -1,10 +1,12 @@
 #!/usr/bin/env bash
 # SPDX-License-Identifier: LGPL-2.1-or-later
 # shellcheck disable=SC2016,SC2209
-
 set -eux
 set -o pipefail
 
+# shellcheck source=test/units/test-control.sh
+. "$(dirname "$0")"/test-control.sh
+
 # Check if homectl is installed, and if it isn't bail out early instead of failing
 if ! command -v homectl >/dev/null; then
     echo "no homed" >/skipped
@@ -47,300 +49,300 @@ mount -t tmpfs tmpfs /home -o size=290M
 # Make sure systemd-homed takes notice of the overmounted /home/
 systemctl kill -sUSR1 systemd-homed
 
-TMP_SKEL=$(mktemp -d)
-echo hogehoge >"$TMP_SKEL"/hoge
+testcase_basic() {
+    local TMP_SKEL
 
-# we enable --luks-discard= since we run our tests in a tight VM, hence don't
-# needlessly pressure for storage. We also set the cheapest KDF, since we don't
-# want to waste CI CPU cycles on it. We also effectively disable rate-limiting on
-# the user by allowing 1000 logins per second
-NEWPASSWORD=xEhErW0ndafV4s homectl create test-user \
-           --disk-size=min \
-           --luks-discard=yes \
-           --image-path=/home/test-user.home \
-           --luks-pbkdf-type=pbkdf2 \
-           --luks-pbkdf-time-cost=1ms \
-           --rate-limit-interval=1s \
-           --rate-limit-burst=1000 \
-           --skel="$TMP_SKEL"
-inspect test-user
+    TMP_SKEL=$(mktemp -d)
+    echo hogehoge >"$TMP_SKEL"/hoge
 
-PASSWORD=xEhErW0ndafV4s homectl authenticate test-user
+    # we enable --luks-discard= since we run our tests in a tight VM, hence don't
+    # needlessly pressure for storage. We also set the cheapest KDF, since we don't
+    # want to waste CI CPU cycles on it. We also effectively disable rate-limiting on
+    # the user by allowing 1000 logins per second
+    NEWPASSWORD=xEhErW0ndafV4s \
+        homectl create test-user \
+        --disk-size=min \
+        --luks-discard=yes \
+        --image-path=/home/test-user.home \
+        --luks-pbkdf-type=pbkdf2 \
+        --luks-pbkdf-time-cost=1ms \
+        --rate-limit-interval=1s \
+        --rate-limit-burst=1000 \
+        --skel="$TMP_SKEL"
+    inspect test-user
 
-PASSWORD=xEhErW0ndafV4s homectl activate test-user
-inspect test-user
+    PASSWORD=xEhErW0ndafV4s homectl authenticate test-user
 
-PASSWORD=xEhErW0ndafV4s homectl update test-user --real-name="Inline test"
-inspect test-user
-
-homectl deactivate test-user
-inspect test-user
-
-PASSWORD=xEhErW0ndafV4s NEWPASSWORD=yPN4N0fYNKUkOq homectl passwd test-user
-inspect test-user
-
-PASSWORD=yPN4N0fYNKUkOq homectl activate test-user
-inspect test-user
-
-SYSTEMD_LOG_LEVEL=debug PASSWORD=yPN4N0fYNKUkOq NEWPASSWORD=xEhErW0ndafV4s homectl passwd test-user
-inspect test-user
-
-homectl deactivate test-user
-inspect test-user
-
-homectl update test-user --real-name "Offline test" --offline
-inspect test-user
-
-PASSWORD=xEhErW0ndafV4s homectl activate test-user
-inspect test-user
-
-# Ensure that the offline changes were propagated in
-grep "Offline test" /home/test-user/.identity
-
-homectl deactivate test-user
-inspect test-user
-
-PASSWORD=xEhErW0ndafV4s homectl update test-user --real-name="Inactive test"
-inspect test-user
-
-PASSWORD=xEhErW0ndafV4s homectl activate test-user
-inspect test-user
-
-homectl deactivate test-user
-inspect test-user
-
-# Do some keyring tests, but only on real kernels, since keyring access inside of containers will fail
-# (See: https://github.com/systemd/systemd/issues/17606)
-if ! systemd-detect-virt -cq ; then
     PASSWORD=xEhErW0ndafV4s homectl activate test-user
     inspect test-user
 
-    # Key should now be in the keyring
-    homectl update test-user --real-name "Keyring Test"
-    inspect test-user
-
-    # These commands shouldn't use the keyring
-    (! timeout 5s homectl authenticate test-user )
-    (! NEWPASSWORD="foobar" timeout 5s homectl passwd test-user )
-
-    homectl lock test-user
-    inspect test-user
-
-    # Key should be gone from keyring
-    (! timeout 5s homectl update test-user --real-name "Keyring Test 2" )
-
-    PASSWORD=xEhErW0ndafV4s homectl unlock test-user
-    inspect test-user
-
-    # Key should have been re-instantiated into the keyring
-    homectl update test-user --real-name "Keyring Test 3"
+    PASSWORD=xEhErW0ndafV4s homectl update test-user --real-name="Inline test"
     inspect test-user
 
     homectl deactivate test-user
     inspect test-user
-fi
 
-# Do some resize tests, but only if we run on real kernels and are on btrfs, as quota inside of containers
-# will fail and minimizing while active only works on btrfs.
-if ! systemd-detect-virt -cq && [[ "$FSTYPE" == "btrfs" ]]; then
-    # grow while inactive
-    PASSWORD=xEhErW0ndafV4s homectl resize test-user 300M
+    PASSWORD=xEhErW0ndafV4s NEWPASSWORD=yPN4N0fYNKUkOq homectl passwd test-user
     inspect test-user
 
-    # minimize while inactive
-    PASSWORD=xEhErW0ndafV4s homectl resize test-user min
+    PASSWORD=yPN4N0fYNKUkOq homectl activate test-user
+    inspect test-user
+
+    SYSTEMD_LOG_LEVEL=debug PASSWORD=yPN4N0fYNKUkOq NEWPASSWORD=xEhErW0ndafV4s homectl passwd test-user
+    inspect test-user
+
+    homectl deactivate test-user
+    inspect test-user
+
+    homectl update test-user --real-name "Offline test" --offline
     inspect test-user
 
     PASSWORD=xEhErW0ndafV4s homectl activate test-user
     inspect test-user
 
-    # grow while active
-    PASSWORD=xEhErW0ndafV4s homectl resize test-user max
+    # Ensure that the offline changes were propagated in
+    grep "Offline test" /home/test-user/.identity
+
+    homectl deactivate test-user
     inspect test-user
 
-    # minimize while active
-    PASSWORD=xEhErW0ndafV4s homectl resize test-user 0
+    PASSWORD=xEhErW0ndafV4s homectl update test-user --real-name="Inactive test"
     inspect test-user
 
-    # grow while active
-    PASSWORD=xEhErW0ndafV4s homectl resize test-user 300M
+    PASSWORD=xEhErW0ndafV4s homectl activate test-user
     inspect test-user
 
-    # shrink to original size while active
-    PASSWORD=xEhErW0ndafV4s homectl resize test-user 256M
+    homectl deactivate test-user
     inspect test-user
 
-    # minimize again
-    PASSWORD=xEhErW0ndafV4s homectl resize test-user min
-    inspect test-user
+    # Do some keyring tests, but only on real kernels, since keyring access inside of containers will fail
+    # (See: https://github.com/systemd/systemd/issues/17606)
+    if ! systemd-detect-virt -cq ; then
+        PASSWORD=xEhErW0ndafV4s homectl activate test-user
+        inspect test-user
 
-    # Increase space, so that we can reasonably rebalance free space between to home dirs
-    mount /home -o remount,size=800M
+        # Key should now be in the keyring
+        homectl update test-user --real-name "Keyring Test"
+        inspect test-user
 
-    # create second user
-    NEWPASSWORD=uuXoo8ei homectl create test-user2 \
-           --disk-size=min \
-           --luks-discard=yes \
-           --image-path=/home/test-user2.home \
-           --luks-pbkdf-type=pbkdf2 \
-           --luks-pbkdf-time-cost=1ms \
-           --rate-limit-interval=1s \
-           --rate-limit-burst=1000
-    inspect test-user2
+        # These commands shouldn't use the keyring
+        (! timeout 5s homectl authenticate test-user )
+        (! NEWPASSWORD="foobar" timeout 5s homectl passwd test-user )
 
-    # activate second user
-    PASSWORD=uuXoo8ei homectl activate test-user2
-    inspect test-user2
+        homectl lock test-user
+        inspect test-user
 
-    # set second user's rebalance weight to 100
-    PASSWORD=uuXoo8ei homectl update test-user2 --rebalance-weight=100
-    inspect test-user2
+        # Key should be gone from keyring
+        (! timeout 5s homectl update test-user --real-name "Keyring Test 2" )
 
-    # set first user's rebalance weight to quarter of that of the second
-    PASSWORD=xEhErW0ndafV4s homectl update test-user --rebalance-weight=25
-    inspect test-user
+        PASSWORD=xEhErW0ndafV4s homectl unlock test-user
+        inspect test-user
 
-    # synchronously rebalance
-    homectl rebalance
-    inspect test-user
-    inspect test-user2
+        # Key should have been re-instantiated into the keyring
+        homectl update test-user --real-name "Keyring Test 3"
+        inspect test-user
 
-    wait_for_state test-user2 active
-    homectl deactivate test-user2
-    wait_for_state test-user2 inactive
-    homectl remove test-user2
-fi
+        homectl deactivate test-user
+        inspect test-user
+    fi
 
-PASSWORD=xEhErW0ndafV4s homectl with test-user -- test ! -f /home/test-user/xyz
-(! PASSWORD=xEhErW0ndafV4s homectl with test-user -- test -f /home/test-user/xyz)
-PASSWORD=xEhErW0ndafV4s homectl with test-user -- touch /home/test-user/xyz
-PASSWORD=xEhErW0ndafV4s homectl with test-user -- test -f /home/test-user/xyz
-PASSWORD=xEhErW0ndafV4s homectl with test-user -- rm /home/test-user/xyz
-PASSWORD=xEhErW0ndafV4s homectl with test-user -- test ! -f /home/test-user/xyz
-(! PASSWORD=xEhErW0ndafV4s homectl with test-user -- test -f /home/test-user/xyz)
-[[ $(PASSWORD=xEhErW0ndafV4s homectl with test-user -- stat -c %U /home/test-user/hoge) == "test-user" ]]
-[[ $(PASSWORD=xEhErW0ndafV4s homectl with test-user -- cat /home/test-user/hoge) == "$(cat "$TMP_SKEL"/hoge)" ]]
+    # Do some resize tests, but only if we run on real kernels and are on btrfs, as quota inside of containers
+    # will fail and minimizing while active only works on btrfs.
+    if ! systemd-detect-virt -cq && [[ "$FSTYPE" == "btrfs" ]]; then
+        # grow while inactive
+        PASSWORD=xEhErW0ndafV4s homectl resize test-user 300M
+        inspect test-user
 
-# Regression tests
-wait_for_state test-user inactive
-/usr/lib/systemd/tests/unit-tests/manual/test-homed-regression-31896 test-user
+        # minimize while inactive
+        PASSWORD=xEhErW0ndafV4s homectl resize test-user min
+        inspect test-user
 
-wait_for_state test-user inactive
-homectl remove test-user
+        PASSWORD=xEhErW0ndafV4s homectl activate test-user
+        inspect test-user
 
-# blob directory tests
-# See docs/USER_RECORD_BLOB_DIRS.md
-checkblob() {
-    test -f "/var/cache/systemd/home/blob-user/$1"
-    stat -c "%u %#a" "/var/cache/systemd/home/blob-user/$1" | grep "^0 0644"
-    test -f "/home/blob-user/.identity-blob/$1"
-    stat -c "%u %#a" "/home/blob-user/.identity-blob/$1" | grep "^12345 0644"
+        # grow while active
+        PASSWORD=xEhErW0ndafV4s homectl resize test-user max
+        inspect test-user
 
-    diff "/var/cache/systemd/home/blob-user/$1" "$2"
-    diff "/var/cache/systemd/home/blob-user/$1" "/home/blob-user/.identity-blob/$1"
+        # minimize while active
+        PASSWORD=xEhErW0ndafV4s homectl resize test-user 0
+        inspect test-user
+
+        # grow while active
+        PASSWORD=xEhErW0ndafV4s homectl resize test-user 300M
+        inspect test-user
+
+        # shrink to original size while active
+        PASSWORD=xEhErW0ndafV4s homectl resize test-user 256M
+        inspect test-user
+
+        # minimize again
+        PASSWORD=xEhErW0ndafV4s homectl resize test-user min
+        inspect test-user
+
+        # Increase space, so that we can reasonably rebalance free space between to home dirs
+        mount /home -o remount,size=800M
+
+        # create second user
+        NEWPASSWORD=uuXoo8ei \
+            homectl create test-user2 \
+            --disk-size=min \
+            --luks-discard=yes \
+            --image-path=/home/test-user2.home \
+            --luks-pbkdf-type=pbkdf2 \
+            --luks-pbkdf-time-cost=1ms \
+            --rate-limit-interval=1s \
+            --rate-limit-burst=1000
+        inspect test-user2
+
+        # activate second user
+        PASSWORD=uuXoo8ei homectl activate test-user2
+        inspect test-user2
+
+        # set second user's rebalance weight to 100
+        PASSWORD=uuXoo8ei homectl update test-user2 --rebalance-weight=100
+        inspect test-user2
+
+        # set first user's rebalance weight to quarter of that of the second
+        PASSWORD=xEhErW0ndafV4s homectl update test-user --rebalance-weight=25
+        inspect test-user
+
+        # synchronously rebalance
+        homectl rebalance
+        inspect test-user
+        inspect test-user2
+
+        wait_for_state test-user2 active
+        homectl deactivate test-user2
+        wait_for_state test-user2 inactive
+        homectl remove test-user2
+    fi
+
+    PASSWORD=xEhErW0ndafV4s homectl with test-user -- test ! -f /home/test-user/xyz
+    (! PASSWORD=xEhErW0ndafV4s homectl with test-user -- test -f /home/test-user/xyz)
+    PASSWORD=xEhErW0ndafV4s homectl with test-user -- touch /home/test-user/xyz
+    PASSWORD=xEhErW0ndafV4s homectl with test-user -- test -f /home/test-user/xyz
+    PASSWORD=xEhErW0ndafV4s homectl with test-user -- rm /home/test-user/xyz
+    PASSWORD=xEhErW0ndafV4s homectl with test-user -- test ! -f /home/test-user/xyz
+    (! PASSWORD=xEhErW0ndafV4s homectl with test-user -- test -f /home/test-user/xyz)
+    [[ "$(PASSWORD=xEhErW0ndafV4s homectl with test-user -- stat -c %U /home/test-user/hoge)" == "test-user" ]]
+    [[ "$(PASSWORD=xEhErW0ndafV4s homectl with test-user -- cat /home/test-user/hoge)" == "$(cat "$TMP_SKEL"/hoge)" ]]
+
+    # Regression tests
+    wait_for_state test-user inactive
+    /usr/lib/systemd/tests/unit-tests/manual/test-homed-regression-31896 test-user
+
+    wait_for_state test-user inactive
+    homectl remove test-user
 }
 
-mkdir /tmp/blob1 /tmp/blob2
-echo data1 blob1 >/tmp/blob1/test1
-echo data1 blob2 >/tmp/blob2/test1
-echo data2 blob1 >/tmp/blob1/test2
-echo data2 blob2 >/tmp/blob2/test2
-echo invalid filename >/tmp/blob1/файл
-echo data3 >/tmp/external-test3
-echo avatardata >/tmp/external-avatar
-ln -s /tmp/external-avatar /tmp/external-avatar-lnk
-dd if=/dev/urandom of=/tmp/external-barely-fits bs=1M count=64
-dd if=/dev/urandom of=/tmp/external-toobig bs=1M count=65
+testcase_blob() {
+    # blob directory tests
+    # See docs/USER_RECORD_BLOB_DIRS.md
+    checkblob() {
+        test -f "/var/cache/systemd/home/blob-user/$1"
+        stat -c "%u %#a" "/var/cache/systemd/home/blob-user/$1" | grep "^0 0644"
+        test -f "/home/blob-user/.identity-blob/$1"
+        stat -c "%u %#a" "/home/blob-user/.identity-blob/$1" | grep "^12345 0644"
 
-# create w/ prepopulated blob dir
-NEWPASSWORD=EMJuc3zQaMibJo homectl create blob-user \
-           --disk-size=min --luks-discard=yes \
-           --luks-pbkdf-type=pbkdf2 --luks-pbkdf-time-cost=1ms \
-           --rate-limit-interval=1s --rate-limit-burst=1000 \
-           --uid=12345 \
-           --blob=/tmp/blob1
-inspect blob-user
-PASSWORD=EMJuc3zQaMibJo homectl activate blob-user
-inspect blob-user
+        diff "/var/cache/systemd/home/blob-user/$1" "$2"
+        diff "/var/cache/systemd/home/blob-user/$1" "/home/blob-user/.identity-blob/$1"
+    }
 
-test -d /var/cache/systemd/home/blob-user
-stat -c "%u %#a" /var/cache/systemd/home/blob-user | grep "^0 0755"
-test -d /home/blob-user/.identity-blob
-stat -c "%u %#a" /home/blob-user/.identity-blob | grep "^12345 0700"
+    mkdir /tmp/blob1 /tmp/blob2
+    echo data1 blob1 >/tmp/blob1/test1
+    echo data1 blob2 >/tmp/blob2/test1
+    echo data2 blob1 >/tmp/blob1/test2
+    echo data2 blob2 >/tmp/blob2/test2
+    echo invalid filename >/tmp/blob1/файл
+    echo data3 >/tmp/external-test3
+    echo avatardata >/tmp/external-avatar
+    ln -s /tmp/external-avatar /tmp/external-avatar-lnk
+    dd if=/dev/urandom of=/tmp/external-barely-fits bs=1M count=64
+    dd if=/dev/urandom of=/tmp/external-toobig bs=1M count=65
 
-checkblob test1 /tmp/blob1/test1
-(! checkblob test1 /tmp/blob2/test1 )
-checkblob test2 /tmp/blob1/test2
-(! checkblob test2 /tmp/blob2/test2 )
-(! checkblob фаил /tmp/blob1/фаил )
-(! checkblob test3 /tmp/external-test3 )
-(! checkblob avatar /tmp/external-avatar )
+    # create w/ prepopulated blob dir
+    NEWPASSWORD=EMJuc3zQaMibJo \
+        homectl create blob-user \
+        --disk-size=min --luks-discard=yes \
+        --luks-pbkdf-type=pbkdf2 --luks-pbkdf-time-cost=1ms \
+        --rate-limit-interval=1s --rate-limit-burst=1000 \
+        --uid=12345 \
+        --blob=/tmp/blob1
+    inspect blob-user
+    PASSWORD=EMJuc3zQaMibJo homectl activate blob-user
+    inspect blob-user
 
-# append files to existing blob, both well-known and other
-PASSWORD=EMJuc3zQaMibJo homectl update blob-user \
+    test -d /var/cache/systemd/home/blob-user
+    stat -c "%u %#a" /var/cache/systemd/home/blob-user | grep "^0 0755"
+    test -d /home/blob-user/.identity-blob
+    stat -c "%u %#a" /home/blob-user/.identity-blob | grep "^12345 0700"
+
+    checkblob test1 /tmp/blob1/test1
+    (! checkblob test1 /tmp/blob2/test1 )
+    checkblob test2 /tmp/blob1/test2
+    (! checkblob test2 /tmp/blob2/test2 )
+    (! checkblob фаил /tmp/blob1/фаил )
+    (! checkblob test3 /tmp/external-test3 )
+    (! checkblob avatar /tmp/external-avatar )
+
+    # append files to existing blob, both well-known and other
+    PASSWORD=EMJuc3zQaMibJo \
+        homectl update blob-user \
         -b test3=/tmp/external-test3 --avatar=/tmp/external-avatar
-inspect blob-user
-checkblob test1 /tmp/blob1/test1
-(! checkblob test1 /tmp/blob2/test1 )
-checkblob test2 /tmp/blob1/test2
-(! checkblob test2 /tmp/blob2/test2 )
-(! checkblob фаил /tmp/blob1/фаил )
-checkblob test3 /tmp/external-test3
-checkblob avatar /tmp/external-avatar
+    inspect blob-user
+    checkblob test1 /tmp/blob1/test1
+    (! checkblob test1 /tmp/blob2/test1 )
+    checkblob test2 /tmp/blob1/test2
+    (! checkblob test2 /tmp/blob2/test2 )
+    (! checkblob фаил /tmp/blob1/фаил )
+    checkblob test3 /tmp/external-test3
+    checkblob avatar /tmp/external-avatar
 
-# delete files from existing blob, both well-known and other
-PASSWORD=EMJuc3zQaMibJo homectl update blob-user \
+    # delete files from existing blob, both well-known and other
+    PASSWORD=EMJuc3zQaMibJo \
+        homectl update blob-user \
         -b test3= --avatar=
-inspect blob-user
-checkblob test1 /tmp/blob1/test1
-(! checkblob test1 /tmp/blob2/test1 )
-checkblob test2 /tmp/blob1/test2
-(! checkblob test2 /tmp/blob2/test2 )
-(! checkblob фаил /tmp/blob1/фаил )
-(! checkblob test3 /tmp/external-test3 )
-(! checkblob avatar /tmp/external-avatar )
+    inspect blob-user
+    checkblob test1 /tmp/blob1/test1
+    (! checkblob test1 /tmp/blob2/test1 )
+    checkblob test2 /tmp/blob1/test2
+    (! checkblob test2 /tmp/blob2/test2 )
+    (! checkblob фаил /tmp/blob1/фаил )
+    (! checkblob test3 /tmp/external-test3 )
+    (! checkblob avatar /tmp/external-avatar )
 
-# swap entire blob directory
-PASSWORD=EMJuc3zQaMibJo homectl update blob-user \
+    # swap entire blob directory
+    PASSWORD=EMJuc3zQaMibJo \
+        homectl update blob-user \
         -b /tmp/blob2
-inspect blob-user
-(! checkblob test1 /tmp/blob1/test1 )
-checkblob test1 /tmp/blob2/test1
-(! checkblob test2 /tmp/blob1/test2 )
-checkblob test2 /tmp/blob2/test2
-(! checkblob фаил /tmp/blob1/фаил )
-(! checkblob test3 /tmp/external-test3 )
-(! checkblob avatar /tmp/external-avatar )
+    inspect blob-user
+    (! checkblob test1 /tmp/blob1/test1 )
+    checkblob test1 /tmp/blob2/test1
+    (! checkblob test2 /tmp/blob1/test2 )
+    checkblob test2 /tmp/blob2/test2
+    (! checkblob фаил /tmp/blob1/фаил )
+    (! checkblob test3 /tmp/external-test3 )
+    (! checkblob avatar /tmp/external-avatar )
 
-# create and delete files while swapping blob directory. Also symlinks.
-PASSWORD=EMJuc3zQaMibJo homectl update blob-user \
+    # create and delete files while swapping blob directory. Also symlinks.
+    PASSWORD=EMJuc3zQaMibJo \
+        homectl update blob-user \
         -b /tmp/blob1 -b test2= -b test3=/tmp/external-test3 --avatar=/tmp/external-avatar-lnk
-inspect blob-user
-checkblob test1 /tmp/blob1/test1
-(! checkblob test1 /tmp/blob2/test1 )
-(! checkblob test2 /tmp/blob1/test2 )
-(! checkblob test2 /tmp/blob2/test2 )
-(! checkblob фаил /tmp/blob1/фаил )
-checkblob test3 /tmp/external-test3
-checkblob avatar /tmp/external-avatar # target of the link
+    inspect blob-user
+    checkblob test1 /tmp/blob1/test1
+    (! checkblob test1 /tmp/blob2/test1 )
+    (! checkblob test2 /tmp/blob1/test2 )
+    (! checkblob test2 /tmp/blob2/test2 )
+    (! checkblob фаил /tmp/blob1/фаил )
+    checkblob test3 /tmp/external-test3
+    checkblob avatar /tmp/external-avatar # target of the link
 
-# clear the blob directory
-PASSWORD=EMJuc3zQaMibJo homectl update blob-user \
+    # clear the blob directory
+    PASSWORD=EMJuc3zQaMibJo \
+        homectl update blob-user \
         -b /tmp/blob2 -b test3=/tmp/external-test3 --blob=
-inspect blob-user
-(! checkblob test1 /tmp/blob1/test1 )
-(! checkblob test1 /tmp/blob2/test1 )
-(! checkblob test2 /tmp/blob1/test2 )
-(! checkblob test2 /tmp/blob2/test2 )
-(! checkblob фаил /tmp/blob1/фаил )
-(! checkblob test3 /tmp/external-test3 )
-(! checkblob avatar /tmp/external-avatar )
-
-# file that's exactly 64M still fits
-# FIXME: Figure out why this fails on ext4.
-if [[ "$FSTYPE" != "ext2/ext3" ]]; then
-    PASSWORD=EMJuc3zQaMibJo homectl update blob-user \
-            -b barely-fits=/tmp/external-barely-fits
+    inspect blob-user
     (! checkblob test1 /tmp/blob1/test1 )
     (! checkblob test1 /tmp/blob2/test1 )
     (! checkblob test2 /tmp/blob1/test2 )
@@ -348,46 +350,62 @@ if [[ "$FSTYPE" != "ext2/ext3" ]]; then
     (! checkblob фаил /tmp/blob1/фаил )
     (! checkblob test3 /tmp/external-test3 )
     (! checkblob avatar /tmp/external-avatar )
-    checkblob barely-fits /tmp/external-barely-fits
-fi
 
-# error out if the file is too big
-(! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b huge=/tmp/external-toobig )
+    # file that's exactly 64M still fits
+    # FIXME: Figure out why this fails on ext4.
+    if [[ "$FSTYPE" != "ext2/ext3" ]]; then
+        PASSWORD=EMJuc3zQaMibJo \
+            homectl update blob-user \
+            -b barely-fits=/tmp/external-barely-fits
+        (! checkblob test1 /tmp/blob1/test1 )
+        (! checkblob test1 /tmp/blob2/test1 )
+        (! checkblob test2 /tmp/blob1/test2 )
+        (! checkblob test2 /tmp/blob2/test2 )
+        (! checkblob фаил /tmp/blob1/фаил )
+        (! checkblob test3 /tmp/external-test3 )
+        (! checkblob avatar /tmp/external-avatar )
+        checkblob barely-fits /tmp/external-barely-fits
+    fi
 
-# error out if filenames are invalid
-(! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b .hidden=/tmp/external-test3 )
-(! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b "with spaces=/tmp/external-test3" )
-(! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b with=equals=/tmp/external-test3 )
-(! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b файл=/tmp/external-test3 )
-(! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b special@chars=/tmp/external-test3 )
+    # error out if the file is too big
+    (! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b huge=/tmp/external-toobig )
 
-# Make sure offline updates to blobs get propagated in
-homectl deactivate blob-user
-inspect blob-user
-homectl update blob-user --offline -b barely-fits= -b propagated=/tmp/external-test3
-inspect blob-user
-PASSWORD=EMJuc3zQaMibJo homectl activate blob-user
-inspect blob-user
-(! checkblob barely-fits /tmp/external-barely-fits )
-checkblob propagated /tmp/external-test3
+    # error out if filenames are invalid
+    (! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b .hidden=/tmp/external-test3 )
+    (! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b "with spaces=/tmp/external-test3" )
+    (! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b with=equals=/tmp/external-test3 )
+    (! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b файл=/tmp/external-test3 )
+    (! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b special@chars=/tmp/external-test3 )
 
-homectl deactivate blob-user
-wait_for_state blob-user inactive
-homectl remove blob-user
+    # Make sure offline updates to blobs get propagated in
+    homectl deactivate blob-user
+    inspect blob-user
+    homectl update blob-user --offline -b barely-fits= -b propagated=/tmp/external-test3
+    inspect blob-user
+    PASSWORD=EMJuc3zQaMibJo homectl activate blob-user
+    inspect blob-user
+    (! checkblob barely-fits /tmp/external-barely-fits )
+    checkblob propagated /tmp/external-test3
 
-# userdbctl tests
-export PAGER=
+    homectl deactivate blob-user
+    wait_for_state blob-user inactive
+    homectl remove blob-user
+}
 
-# Create a couple of user/group records to test io.systemd.DropIn
-# See docs/USER_RECORD.md and docs/GROUP_RECORD.md
-mkdir -p /run/userdb/
-cat >"/run/userdb/dropingroup.group" <<\EOF
+testcase_userdbctl() {
+    # userdbctl tests
+    export PAGER=
+
+    # Create a couple of user/group records to test io.systemd.DropIn
+    # See docs/USER_RECORD.md and docs/GROUP_RECORD.md
+    mkdir -p /run/userdb/
+    cat >"/run/userdb/dropingroup.group" <<\EOF
 {
     "groupName" : "dropingroup",
     "gid"       : 1000000
 }
 EOF
-cat >"/run/userdb/dropinuser.user" <<\EOF
+    cat >"/run/userdb/dropinuser.user" <<\EOF
 {
     "userName" : "dropinuser",
     "uid"      : 2000000,
@@ -397,7 +415,7 @@ cat >"/run/userdb/dropinuser.user" <<\EOF
     ]
 }
 EOF
-cat >"/run/userdb/dropinuser.user-privileged" <<\EOF
+    cat >"/run/userdb/dropinuser.user-privileged" <<\EOF
 {
     "privileged" : {
         "hashedPassword" : [
@@ -410,161 +428,172 @@ cat >"/run/userdb/dropinuser.user-privileged" <<\EOF
     }
 }
 EOF
-# Set permissions and create necessary symlinks as described in nss-systemd(8)
-chmod 0600 "/run/userdb/dropinuser.user-privileged"
-ln -svrf "/run/userdb/dropingroup.group" "/run/userdb/1000000.group"
-ln -svrf "/run/userdb/dropinuser.user" "/run/userdb/2000000.user"
-ln -svrf "/run/userdb/dropinuser.user-privileged" "/run/userdb/2000000.user-privileged"
+    # Set permissions and create necessary symlinks as described in nss-systemd(8)
+    chmod 0600 "/run/userdb/dropinuser.user-privileged"
+    ln -svrf "/run/userdb/dropingroup.group" "/run/userdb/1000000.group"
+    ln -svrf "/run/userdb/dropinuser.user" "/run/userdb/2000000.user"
+    ln -svrf "/run/userdb/dropinuser.user-privileged" "/run/userdb/2000000.user-privileged"
 
-userdbctl
-userdbctl --version
-userdbctl --help --no-pager
-userdbctl --no-legend
-userdbctl --output=classic
-userdbctl --output=friendly
-userdbctl --output=table
-userdbctl --output=json | jq
-userdbctl -j --json=pretty | jq
-userdbctl -j --json=short | jq
-userdbctl --with-varlink=no
+    userdbctl
+    userdbctl --version
+    userdbctl --help --no-pager
+    userdbctl --no-legend
+    userdbctl --output=classic
+    userdbctl --output=friendly
+    userdbctl --output=table
+    userdbctl --output=json | jq
+    userdbctl -j --json=pretty | jq
+    userdbctl -j --json=short | jq
+    userdbctl --with-varlink=no
 
-userdbctl user
-userdbctl user -S
-userdbctl user -IS
-userdbctl user -R
-userdbctl user --disposition=regular --disposition=intrinsic
-userdbctl user kkkk -z
-userdbctl user --uid-min=100 --uid-max=100
-userdbctl user -B
-userdbctl user testuser
-userdbctl user root
-userdbctl user testuser root
-userdbctl user -j testuser root | jq
-# Check only UID for the nobody user, since the name is build-configurable
-userdbctl user --with-nss=no --synthesize=yes
-userdbctl user --with-nss=no --synthesize=yes 0 root 65534
-userdbctl user dropinuser
-userdbctl user 2000000
-userdbctl user --with-nss=no --with-varlink=no --synthesize=no --multiplexer=no dropinuser
-userdbctl user --with-nss=no 2000000
-(! userdbctl user '')
-(! userdbctl user 🐱)
-(! userdbctl user 🐱 '' bar)
-(! userdbctl user i-do-not-exist)
-(! userdbctl user root i-do-not-exist testuser)
-(! userdbctl user --with-nss=no --synthesize=no 0 root 65534)
-(! userdbctl user -N root nobody)
-(! userdbctl user --with-dropin=no dropinuser)
-(! userdbctl user --with-dropin=no 2000000)
+    userdbctl user
+    userdbctl user -S
+    userdbctl user -IS
+    userdbctl user -R
+    userdbctl user --disposition=regular --disposition=intrinsic
+    userdbctl user kkkk -z
+    userdbctl user --uid-min=100 --uid-max=100
+    userdbctl user -B
+    userdbctl user testuser
+    userdbctl user root
+    userdbctl user testuser root
+    userdbctl user -j testuser root | jq
+    # Check only UID for the nobody user, since the name is build-configurable
+    userdbctl user --with-nss=no --synthesize=yes
+    userdbctl user --with-nss=no --synthesize=yes 0 root 65534
+    userdbctl user dropinuser
+    userdbctl user 2000000
+    userdbctl user --with-nss=no --with-varlink=no --synthesize=no --multiplexer=no dropinuser
+    userdbctl user --with-nss=no 2000000
+    (! userdbctl user '')
+    (! userdbctl user 🐱)
+    (! userdbctl user 🐱 '' bar)
+    (! userdbctl user i-do-not-exist)
+    (! userdbctl user root i-do-not-exist testuser)
+    (! userdbctl user --with-nss=no --synthesize=no 0 root 65534)
+    (! userdbctl user -N root nobody)
+    (! userdbctl user --with-dropin=no dropinuser)
+    (! userdbctl user --with-dropin=no 2000000)
 
-userdbctl group
-userdbctl group -S
-userdbctl group -IS
-userdbctl group -R
-userdbctl group --disposition=regular --disposition=intrinsic
-userdbctl group kkkk -z
-userdbctl group --uid-min=100 --uid-max=100
-userdbctl group -B
-userdbctl group testuser
-userdbctl group root
-userdbctl group testuser root
-userdbctl group -j testuser root | jq
-# Check only GID for the nobody group, since the name is build-configurable
-userdbctl group --with-nss=no --synthesize=yes
-userdbctl group --with-nss=no --synthesize=yes 0 root 65534
-userdbctl group dropingroup
-userdbctl group 1000000
-userdbctl group --with-nss=no --with-varlink=no --synthesize=no --multiplexer=no dropingroup
-userdbctl group --with-nss=no 1000000
-(! userdbctl group '')
-(! userdbctl group 🐱)
-(! userdbctl group 🐱 '' bar)
-(! userdbctl group i-do-not-exist)
-(! userdbctl group root i-do-not-exist testuser)
-(! userdbctl group --with-nss=no --synthesize=no 0 root 65534)
-(! userdbctl group --with-dropin=no dropingroup)
-(! userdbctl group --with-dropin=no 1000000)
+    userdbctl group
+    userdbctl group -S
+    userdbctl group -IS
+    userdbctl group -R
+    userdbctl group --disposition=regular --disposition=intrinsic
+    userdbctl group kkkk -z
+    userdbctl group --uid-min=100 --uid-max=100
+    userdbctl group -B
+    userdbctl group testuser
+    userdbctl group root
+    userdbctl group testuser root
+    userdbctl group -j testuser root | jq
+    # Check only GID for the nobody group, since the name is build-configurable
+    userdbctl group --with-nss=no --synthesize=yes
+    userdbctl group --with-nss=no --synthesize=yes 0 root 65534
+    userdbctl group dropingroup
+    userdbctl group 1000000
+    userdbctl group --with-nss=no --with-varlink=no --synthesize=no --multiplexer=no dropingroup
+    userdbctl group --with-nss=no 1000000
+    (! userdbctl group '')
+    (! userdbctl group 🐱)
+    (! userdbctl group 🐱 '' bar)
+    (! userdbctl group i-do-not-exist)
+    (! userdbctl group root i-do-not-exist testuser)
+    (! userdbctl group --with-nss=no --synthesize=no 0 root 65534)
+    (! userdbctl group --with-dropin=no dropingroup)
+    (! userdbctl group --with-dropin=no 1000000)
 
-userdbctl users-in-group
-userdbctl users-in-group testuser
-userdbctl users-in-group testuser root
-userdbctl users-in-group -j testuser root | jq
-userdbctl users-in-group 🐱
-(! userdbctl users-in-group '')
-(! userdbctl users-in-group foo '' bar)
+    userdbctl users-in-group
+    userdbctl users-in-group testuser
+    userdbctl users-in-group testuser root
+    userdbctl users-in-group -j testuser root | jq
+    userdbctl users-in-group 🐱
+    (! userdbctl users-in-group '')
+    (! userdbctl users-in-group foo '' bar)
 
-userdbctl groups-of-user
-userdbctl groups-of-user testuser
-userdbctl groups-of-user testuser root
-userdbctl groups-of-user -j testuser root | jq
-userdbctl groups-of-user 🐱
-(! userdbctl groups-of-user '')
-(! userdbctl groups-of-user foo '' bar)
+    userdbctl groups-of-user
+    userdbctl groups-of-user testuser
+    userdbctl groups-of-user testuser root
+    userdbctl groups-of-user -j testuser root | jq
+    userdbctl groups-of-user 🐱
+    (! userdbctl groups-of-user '')
+    (! userdbctl groups-of-user foo '' bar)
 
-userdbctl services
-userdbctl services -j | jq
+    userdbctl services
+    userdbctl services -j | jq
 
-varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"testuser","service":"io.systemd.Multiplexer"}'
-varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"root","service":"io.systemd.Multiplexer"}'
-varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"dropinuser","service":"io.systemd.Multiplexer"}'
-varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"uid":2000000,"service":"io.systemd.Multiplexer"}'
-(! varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"","service":"io.systemd.Multiplexer"}')
-(! varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"🐱","service":"io.systemd.Multiplexer"}')
-(! varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"i-do-not-exist","service":"io.systemd.Multiplexer"}')
+    varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"testuser","service":"io.systemd.Multiplexer"}'
+    varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"root","service":"io.systemd.Multiplexer"}'
+    varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"dropinuser","service":"io.systemd.Multiplexer"}'
+    varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"uid":2000000,"service":"io.systemd.Multiplexer"}'
+    (! varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"","service":"io.systemd.Multiplexer"}')
+    (! varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"🐱","service":"io.systemd.Multiplexer"}')
+    (! varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"i-do-not-exist","service":"io.systemd.Multiplexer"}')
 
-userdbctl ssh-authorized-keys dropinuser | tee /tmp/authorized-keys
-grep "ssh-ed25519" /tmp/authorized-keys
-grep "ecdsa-sha2-nistp256" /tmp/authorized-keys
-echo "my-top-secret-key 🐱" >/tmp/my-top-secret-key
-userdbctl ssh-authorized-keys dropinuser --chain /usr/bin/cat /tmp/my-top-secret-key | tee /tmp/authorized-keys
-grep "ssh-ed25519" /tmp/authorized-keys
-grep "ecdsa-sha2-nistp256" /tmp/authorized-keys
-grep "my-top-secret-key 🐱" /tmp/authorized-keys
-(! userdbctl ssh-authorized-keys 🐱)
-(! userdbctl ssh-authorized-keys dropin-user --chain)
-(! userdbctl ssh-authorized-keys dropin-user --chain '')
-(! SYSTEMD_LOG_LEVEL=debug userdbctl ssh-authorized-keys dropin-user --chain /usr/bin/false)
+    userdbctl ssh-authorized-keys dropinuser | tee /tmp/authorized-keys
+    grep "ssh-ed25519" /tmp/authorized-keys
+    grep "ecdsa-sha2-nistp256" /tmp/authorized-keys
+    echo "my-top-secret-key 🐱" >/tmp/my-top-secret-key
+    userdbctl ssh-authorized-keys dropinuser --chain /usr/bin/cat /tmp/my-top-secret-key | tee /tmp/authorized-keys
+    grep "ssh-ed25519" /tmp/authorized-keys
+    grep "ecdsa-sha2-nistp256" /tmp/authorized-keys
+    grep "my-top-secret-key 🐱" /tmp/authorized-keys
+    (! userdbctl ssh-authorized-keys 🐱)
+    (! userdbctl ssh-authorized-keys dropin-user --chain)
+    (! userdbctl ssh-authorized-keys dropin-user --chain '')
+    (! SYSTEMD_LOG_LEVEL=debug userdbctl ssh-authorized-keys dropin-user --chain /usr/bin/false)
 
-(! userdbctl '')
-for opt in json multiplexer output synthesize with-dropin with-nss with-varlink; do
-    (! userdbctl "--$opt=''")
-    (! userdbctl "--$opt='🐱'")
-    (! userdbctl "--$opt=foo")
-    (! userdbctl "--$opt=foo" "--$opt=''" "--$opt=🐱")
-done
+    (! userdbctl '')
+    for opt in json multiplexer output synthesize with-dropin with-nss with-varlink; do
+        (! userdbctl "--$opt=''")
+        (! userdbctl "--$opt='🐱'")
+        (! userdbctl "--$opt=foo")
+        (! userdbctl "--$opt=foo" "--$opt=''" "--$opt=🐱")
+    done
+}
 
-# FIXME: sshd seems to crash inside asan currently, skip the actual ssh test hence
-if command -v ssh >/dev/null && command -v sshd >/dev/null && ! [[ -v ASAN_OPTIONS ]]; then
-    at_exit() {
-        set +e
+cleanup_ssh() (
+    set +e
 
-        systemctl is-active -q mysshserver.socket && systemctl stop mysshserver.socket
-        rm -f /tmp/homed.id_ecdsa /run/systemd/system/mysshserver{@.service,.socket}
-        systemctl daemon-reload
-        wait_for_state homedsshtest inactive
-        homectl remove homedsshtest
-        for dir in /etc /usr/lib; do
-            if [[ -f "$dir/pam.d/sshd.bak" ]]; then
-                mv "$dir/pam.d/sshd.bak" "$dir/pam.d/sshd"
-            fi
-        done
-    }
+    systemctl is-active -q mysshserver.socket && systemctl stop mysshserver.socket
+    rm -f /tmp/homed.id_ecdsa /run/systemd/system/mysshserver{@.service,.socket}
+    systemctl daemon-reload
+    wait_for_state homedsshtest inactive
+    homectl remove homedsshtest
+    for dir in /etc /usr/lib; do
+        if [[ -f "$dir/pam.d/sshd.bak" ]]; then
+            mv "$dir/pam.d/sshd.bak" "$dir/pam.d/sshd"
+        fi
+    done
+)
 
-    trap at_exit EXIT
+testcase_ssh() {
+    # FIXME: sshd seems to crash inside asan currently, skip the actual ssh test hence
+    if [[ -v ASAN_OPTIONS ]]; then
+        return 0
+    fi
+
+    if ! command -v ssh >/dev/null || ! command -v sshd >/dev/null; then
+        echo "ssh/sshd is not installed, skipping the ssh test."
+        return 0
+    fi
+
+    trap cleanup_ssh RETURN ERR EXIT
 
     # Test that SSH logins work with delayed unlocking
     ssh-keygen -N '' -C '' -t ecdsa -f /tmp/homed.id_ecdsa
-    NEWPASSWORD=hunter4711 homectl create \
-                       --disk-size=min \
-                       --luks-discard=yes \
-                       --luks-pbkdf-type=pbkdf2 \
-                       --luks-pbkdf-time-cost=1ms \
-                       --rate-limit-interval=1s \
-                       --rate-limit-burst=1000 \
-                       --enforce-password-policy=no \
-                       --ssh-authorized-keys=@/tmp/homed.id_ecdsa.pub \
-                       --stop-delay=0 \
-                       homedsshtest
+    NEWPASSWORD=hunter4711 \
+        homectl create \
+        --disk-size=min \
+        --luks-discard=yes \
+        --luks-pbkdf-type=pbkdf2 \
+        --luks-pbkdf-time-cost=1ms \
+        --rate-limit-interval=1s \
+        --rate-limit-burst=1000 \
+        --enforce-password-policy=no \
+        --ssh-authorized-keys=@/tmp/homed.id_ecdsa.pub \
+        --stop-delay=0 \
+        homedsshtest
     homectl inspect homedsshtest
 
     mkdir -p /etc/ssh
@@ -628,82 +657,84 @@ EOF
     ssh -t -t -4 -p 4711 -i /tmp/homed.id_ecdsa \
         -o "SetEnv PASSWORD=hunter4711" -o "StrictHostKeyChecking no" \
         homedsshtest@localhost env
+}
 
-    trap - EXIT
-    at_exit
-fi
+testcase_alias() {
+    NEWPASSWORD=hunter4711 homectl create aliastest --storage=directory --alias=aliastest2 --alias=aliastest3 --realm=myrealm
 
-NEWPASSWORD=hunter4711 homectl create aliastest --storage=directory --alias=aliastest2 --alias=aliastest3 --realm=myrealm
+    homectl inspect aliastest
+    homectl inspect aliastest2
+    homectl inspect aliastest3
+    homectl inspect aliastest@myrealm
+    homectl inspect aliastest2@myrealm
+    homectl inspect aliastest3@myrealm
 
-homectl inspect aliastest
-homectl inspect aliastest2
-homectl inspect aliastest3
-homectl inspect aliastest@myrealm
-homectl inspect aliastest2@myrealm
-homectl inspect aliastest3@myrealm
+    userdbctl user aliastest
+    userdbctl user aliastest2
+    userdbctl user aliastest3
+    userdbctl user aliastest@myrealm
+    userdbctl user aliastest2@myrealm
+    userdbctl user aliastest3@myrealm
 
-userdbctl user aliastest
-userdbctl user aliastest2
-userdbctl user aliastest3
-userdbctl user aliastest@myrealm
-userdbctl user aliastest2@myrealm
-userdbctl user aliastest3@myrealm
+    getent passwd aliastest
+    getent passwd aliastest2
+    getent passwd aliastest3
+    getent passwd aliastest@myrealm
+    getent passwd aliastest2@myrealm
+    getent passwd aliastest3@myrealm
 
-getent passwd aliastest
-getent passwd aliastest2
-getent passwd aliastest3
-getent passwd aliastest@myrealm
-getent passwd aliastest2@myrealm
-getent passwd aliastest3@myrealm
+    homectl remove aliastest
+}
 
-homectl remove aliastest
+testcase_quota() {
+    NEWPASSWORD=quux homectl create tmpfsquota --storage=subvolume --dev-shm-limit=50K --tmp-limit=50K -P
+    for p in /dev/shm /tmp; do
+        if findmnt -n -o options "$p" | grep -q usrquota; then
+            # Check if we can display the quotas. If we cannot, than it's likely
+            # that PID1 was also not able to set the limits and we should not fail
+            # in the tests below.
+            /usr/lib/systemd/tests/unit-tests/manual/test-display-quota tmpfsquota "$p" || set +e
 
-NEWPASSWORD=quux homectl create tmpfsquota --storage=subvolume --dev-shm-limit=50K --tmp-limit=50K -P
-for p in /dev/shm /tmp; do
-    if findmnt -n -o options "$p" | grep -q usrquota; then
-        # Check if we can display the quotas. If we cannot, than it's likely
-        # that PID1 was also not able to set the limits and we should not fail
-        # in the tests below.
-        /usr/lib/systemd/tests/unit-tests/manual/test-display-quota tmpfsquota "$p" || set +e
+            run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u tmpfsquota dd if=/dev/zero of="$p/quotatestfile1" bs=1024 count=30
+            (! run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u tmpfsquota dd if=/dev/zero of="$p/quotatestfile2" bs=1024 count=30)
+            run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u tmpfsquota rm "$p/quotatestfile1" "$p/quotatestfile2"
+            run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u tmpfsquota dd if=/dev/zero of="$p/quotatestfile1" bs=1024 count=30
+            run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u tmpfsquota rm "$p/quotatestfile1"
 
-        run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u tmpfsquota dd if=/dev/zero of="$p/quotatestfile1" bs=1024 count=30
-        (! run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u tmpfsquota dd if=/dev/zero of="$p/quotatestfile2" bs=1024 count=30)
-        run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u tmpfsquota rm "$p/quotatestfile1" "$p/quotatestfile2"
-        run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u tmpfsquota dd if=/dev/zero of="$p/quotatestfile1" bs=1024 count=30
-        run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u tmpfsquota rm "$p/quotatestfile1"
+            set -e
+        fi
+    done
 
-        set -e
-    fi
-done
+    systemctl stop user@"$(id -u tmpfsquota)".service
+    wait_for_state tmpfsquota inactive
+    homectl remove tmpfsquota
+}
 
-systemctl stop user@"$(id -u tmpfsquota)".service
-wait_for_state tmpfsquota inactive
-homectl remove tmpfsquota
+testcase_subarea() {
+    NEWPASSWORD=quux homectl create subareatest --storage=subvolume -P
+    run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest mkdir Areas
+    run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest cp -av /etc/skel Areas/furb
+    run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest cp -av /etc/skel Areas/molb
+    run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest ln -s /home/srub Areas/srub
+    run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest ln -s /root Areas/root
 
-NEWPASSWORD=quux homectl create subareatest --storage=subvolume -P
-run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest mkdir Areas
-run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest cp -av /etc/skel Areas/furb
-run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest cp -av /etc/skel Areas/molb
-run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest ln -s /home/srub Areas/srub
-run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest ln -s /root Areas/root
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest bash -c 'echo $HOME')" = "/home/subareatest"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest bash -c 'echo x$XDG_AREA')" = "x"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $HOME')" = "/home/subareatest/Areas/furb"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $XDG_AREA')" = "furb"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/furb"
 
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest bash -c 'echo $HOME')" = "/home/subareatest"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest bash -c 'echo x$XDG_AREA')" = "x"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $HOME')" = "/home/subareatest/Areas/furb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $XDG_AREA')" = "furb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/furb"
+    PASSWORD=quux homectl update subareatest --default-area=molb
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest bash -c 'echo $HOME')" = "/home/subareatest/Areas/molb"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest bash -c 'echo $XDG_AREA')" = "molb"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/molb"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $HOME')" = "/home/subareatest/Areas/furb"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $XDG_AREA')" = "furb"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/furb"
 
-PASSWORD=quux homectl update subareatest --default-area=molb
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest bash -c 'echo $HOME')" = "/home/subareatest/Areas/molb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest bash -c 'echo $XDG_AREA')" = "molb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/molb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $HOME')" = "/home/subareatest/Areas/furb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $XDG_AREA')" = "furb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/furb"
-
-# Install a PK rule that allows 'subareatest' user to invoke run0 without password, just for testing
-cat >/usr/share/polkit-1/rules.d/subareatest.rules <<'EOF'
+    # Install a PK rule that allows 'subareatest' user to invoke run0 without password, just for testing
+    cat >/usr/share/polkit-1/rules.d/subareatest.rules <<'EOF'
 polkit.addRule(function(action, subject) {
     if (action.id == "org.freedesktop.systemd1.manage-units" &&
         subject.user == "subareatest") {
@@ -712,137 +743,169 @@ polkit.addRule(function(action, subject) {
 });
 EOF
 
-# Test "recursive" operation
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb bash -c 'echo $HOME')" = "/home/subareatest/Areas/molb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb bash -c 'echo $XDG_AREA')" = "molb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/molb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $HOME')" = "/home/subareatest/Areas/furb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $XDG_AREA')" = "furb"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/furb"
+    # Test "recursive" operation
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb bash -c 'echo $HOME')" = "/home/subareatest/Areas/molb"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb bash -c 'echo $XDG_AREA')" = "molb"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/molb"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $HOME')" = "/home/subareatest/Areas/furb"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $XDG_AREA')" = "furb"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=molb run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=furb bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/furb"
 
-# Test symlinked area
-mkdir -p /home/srub
-chown subareatest:subareatest /home/srub
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=srub bash -c 'echo $HOME')" = "/home/srub"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=srub bash -c 'echo $XDG_AREA')" = "srub"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=srub bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/srub"
+    # Test symlinked area
+    mkdir -p /home/srub
+    chown subareatest:subareatest /home/srub
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=srub bash -c 'echo $HOME')" = "/home/srub"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=srub bash -c 'echo $XDG_AREA')" = "srub"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=srub bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)/Areas/srub"
 
-# Verify that login into an area not owned by target user will be redirected to main area
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=root bash -c 'echo $HOME')" = "/home/subareatest"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=root bash -c 'echo x$XDG_AREA')" = "x"
-test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=root bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)"
+    # Verify that login into an area not owned by target user will be redirected to main area
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=root bash -c 'echo $HOME')" = "/home/subareatest"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=root bash -c 'echo x$XDG_AREA')" = "x"
+    test "$(run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest --area=root bash -c 'echo $XDG_RUNTIME_DIR')" = "/run/user/$(id -u subareatest)"
 
-systemctl stop user@"$(id -u subareatest)".service
+    systemctl stop user@"$(id -u subareatest)".service
 
-wait_for_state subareatest inactive
-homectl remove subareatest
+    wait_for_state subareatest inactive
+    homectl remove subareatest
+}
 
-# Test signing key logic
-homectl list-signing-keys | grep -q local.public
-(! (homectl list-signing-keys | grep -q signtest.public))
+testcase_sign() {
+    # Test signing key logic
+    homectl list-signing-keys | grep -q local.public
+    (! (homectl list-signing-keys | grep -q signtest.public))
 
-IDENTITY='{"userName":"signtest","storage":"directory","disposition":"regular","privileged":{"hashedPassword":["$y$j9T$I5Wxfm.fyg.RRWlgWw.rI1$gnQqGtbpPexqxZJkWMq8FxQi5Swc.CWeKtM8LwvEUB6"]},"enforcePasswordPolicy":false,"lastChangeUSec":1740677608017608,"lastPasswordChangeUSec":1740677608017608,"signature":[{"data":"Gl4wtc0sMjVnsH6FQwG/0M+x0nLI5cvvdtSSCttUu1gNtXqYn0UI4wZi/7zX35ERht6XHWDlP4d6V8HiAst4Dg==","key":"-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA6uvVaP1vh7O6nIbiOcvyIHRl4ihYSs0R7ctxtz2Zu7E=\n-----END PUBLIC KEY-----\n"}],"secret":{"password":["test"]}}'
+    print_identity() {
+        cat <<\EOF
+{
+    "userName" : "signtest",
+    "storage" : "directory",
+    "disposition" : "regular",
+    "privileged" : {
+        "hashedPassword" : [
+            "$y$j9T$I5Wxfm.fyg.RRWlgWw.rI1$gnQqGtbpPexqxZJkWMq8FxQi5Swc.CWeKtM8LwvEUB6"
+        ]
+    },
+    "enforcePasswordPolicy" : false,
+    "lastChangeUSec" : 1740677608017608,
+    "lastPasswordChangeUSec" : 1740677608017608,
+    "signature" : [
+        {
+            "data" : "Gl4wtc0sMjVnsH6FQwG/0M+x0nLI5cvvdtSSCttUu1gNtXqYn0UI4wZi/7zX35ERht6XHWDlP4d6V8HiAst4Dg==",
+            "key" : "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA6uvVaP1vh7O6nIbiOcvyIHRl4ihYSs0R7ctxtz2Zu7E=\n-----END PUBLIC KEY-----\n"
+        }
+    ],
+    "secret" : {
+        "password" : [
+            "test"
+        ]
+    }
+}
+EOF
+    }
 
-# Try with stripping the foreign signature first, this should just work
-echo "$IDENTITY" | homectl create -P --identity=- --seize=yes
-wait_for_state signtest inactive
-homectl remove signtest
+    # Try with stripping the foreign signature first, this should just work
+    print_identity | homectl create -P --identity=- --seize=yes
+    wait_for_state signtest inactive
+    homectl remove signtest
 
-# No try again, and don't strip the signature. It will be refused.
-(! (echo "$IDENTITY" | homectl create -P --identity=- --seize=no))
+    # No try again, and don't strip the signature. It will be refused.
+    (! (print_identity | homectl create -P --identity=- --seize=no))
 
-print_public_key() {
-    cat <<EOF
+    print_public_key() {
+        cat <<EOF
 -----BEGIN PUBLIC KEY-----
 MCowBQYDK2VwAyEA6uvVaP1vh7O6nIbiOcvyIHRl4ihYSs0R7ctxtz2Zu7E=
 -----END PUBLIC KEY-----
 EOF
+    }
+
+    # Let's now add the signing key
+    print_public_key | homectl add-signing-key --key-name=signtest.public
+    homectl get-signing-key signtest.public | cmp - <(print_public_key)
+    homectl list-signing-keys | grep -q local.public
+    homectl list-signing-keys | grep -q signtest.public
+
+    # Now create the account with this, it should work now
+    print_identity | homectl create -P --identity=- --seize=no
+
+    # Verify we can log in
+    PASSWORD="test" homectl with signtest true
+
+    # Remove the key, and check again ,should fail now
+    wait_for_state signtest inactive
+    homectl remove-signing-key signtest.public
+    wait_for_state signtest inactive
+    (! PASSWORD="test" homectl with signtest true)
+
+    # Verify key is really gone
+    homectl list-signing-keys | grep -q local.public
+    (! (homectl list-signing-keys | grep -q signtest.public))
+
+    # Test unregister + adopt
+    mkdir /home/elsewhere
+    mv /home/signtest.homedir /home/elsewhere/
+    wait_for_state signtest absent
+    homectl unregister signtest
+    print_public_key | homectl add-signing-key --key-name=signtest.public
+    homectl adopt /home/elsewhere/signtest.homedir
+    PASSWORD="test" homectl with signtest true
+
+    # Test register
+    wait_for_state signtest inactive
+    homectl unregister signtest
+    homectl register /home/elsewhere/signtest.homedir/.identity
+    wait_for_state signtest absent
+    homectl unregister signtest
+
+    # Test automatic fixation for anything in /home/
+    mv /home/elsewhere/signtest.homedir /home
+    rmdir /home/elsewhere
+    wait_for_exist signtest
+    PASSWORD="test" homectl with signtest true
+
+    # add signing key via credential
+    wait_for_state signtest inactive
+    homectl remove-signing-key signtest.public
+    (! (homectl list-signing-keys | grep -q signtest.public))
+    systemd-run --wait -p "SetCredential=home.add-signing-key.signtest.public:$(print_public_key)" homectl firstboot
+    homectl list-signing-keys | grep -q signtest.public
+
+    # register user via credential
+    mkdir /home/elsewhere2
+    mv /home/signtest.homedir /home/elsewhere2/
+    wait_for_state signtest absent
+    homectl unregister signtest
+    systemd-run --wait -p "LoadCredential=home.register.signtest:/home/elsewhere2/signtest.homedir/.identity" homectl firstboot
+    homectl inspect signtest
+    wait_for_state signtest absent
+    homectl unregister signtest
+    mv /home/elsewhere2/signtest.homedir /home/
+    rmdir /home/elsewhere2
+
+    # Remove it all again
+    wait_for_exist signtest
+    homectl remove-signing-key signtest.public
+    homectl remove signtest
 }
 
-# Let's now add the signing key
-print_public_key | homectl add-signing-key --key-name=signtest.public
-homectl get-signing-key signtest.public | cmp - <(print_public_key)
-homectl list-signing-keys | grep -q local.public
-homectl list-signing-keys | grep -q signtest.public
+testcase_match() {
+    # Test positive and negative matching
+    NEWPASSWORD=test homectl create --storage=directory --nice=5 -P matchtest
+    homectl inspect matchtest
+    homectl inspect matchtest | grep "Nice: 5"
+    PASSWORD=test homectl update -N --nice=7 -T --nice=3 matchtest
+    homectl inspect matchtest
+    homectl inspect matchtest | grep "Nice: 3"
+    PASSWORD=test homectl update -A --default-area=quux1 matchtest
+    homectl inspect matchtest
+    homectl inspect matchtest | grep "Area: quux1"
+    PASSWORD=test homectl update -N --default-area=quux2 matchtest
+    homectl inspect matchtest
+    homectl inspect matchtest | grep "Area: quux1"
+    PASSWORD=test homectl update -T --default-area=quux3 matchtest
+    homectl inspect matchtest
+    homectl inspect matchtest | grep "Area: quux3"
+    homectl remove matchtest
+}
 
-# Now create the account with this, it should work now
-echo "$IDENTITY" | homectl create -P --identity=- --seize=no
-
-# Verify we can log in
-PASSWORD="test" homectl with signtest true
-
-# Remove the key, and check again ,should fail now
-wait_for_state signtest inactive
-homectl remove-signing-key signtest.public
-wait_for_state signtest inactive
-(! PASSWORD="test" homectl with signtest true)
-
-# Verify key is really gone
-homectl list-signing-keys | grep -q local.public
-(! (homectl list-signing-keys | grep -q signtest.public))
-
-# Test unregister + adopt
-mkdir /home/elsewhere
-mv /home/signtest.homedir /home/elsewhere/
-wait_for_state signtest absent
-homectl unregister signtest
-print_public_key | homectl add-signing-key --key-name=signtest.public
-homectl adopt /home/elsewhere/signtest.homedir
-PASSWORD="test" homectl with signtest true
-
-# Test register
-wait_for_state signtest inactive
-homectl unregister signtest
-homectl register /home/elsewhere/signtest.homedir/.identity
-wait_for_state signtest absent
-homectl unregister signtest
-
-# Test automatic fixation for anything in /home/
-mv /home/elsewhere/signtest.homedir /home
-rmdir /home/elsewhere
-wait_for_exist signtest
-PASSWORD="test" homectl with signtest true
-
-# add signing key via credential
-wait_for_state signtest inactive
-homectl remove-signing-key signtest.public
-(! (homectl list-signing-keys | grep -q signtest.public))
-systemd-run --wait -p "SetCredential=home.add-signing-key.signtest.public:$(print_public_key)" homectl firstboot
-homectl list-signing-keys | grep -q signtest.public
-
-# register user via credential
-mkdir /home/elsewhere2
-mv /home/signtest.homedir /home/elsewhere2/
-wait_for_state signtest absent
-homectl unregister signtest
-systemd-run --wait -p "LoadCredential=home.register.signtest:/home/elsewhere2/signtest.homedir/.identity" homectl firstboot
-homectl inspect signtest
-wait_for_state signtest absent
-homectl unregister signtest
-mv /home/elsewhere2/signtest.homedir /home/
-rmdir /home/elsewhere2
-
-# Remove it all again
-wait_for_exist signtest
-homectl remove-signing-key signtest.public
-homectl remove signtest
-
-# Test positive and negative matching
-NEWPASSWORD=test homectl create --storage=directory --nice=5 -P matchtest
-homectl inspect matchtest
-homectl inspect matchtest | grep "Nice: 5"
-PASSWORD=test homectl update -N --nice=7 -T --nice=3 matchtest
-homectl inspect matchtest
-homectl inspect matchtest | grep "Nice: 3"
-PASSWORD=test homectl update -A --default-area=quux1 matchtest
-homectl inspect matchtest
-homectl inspect matchtest | grep "Area: quux1"
-PASSWORD=test homectl update -N --default-area=quux2 matchtest
-homectl inspect matchtest
-homectl inspect matchtest | grep "Area: quux1"
-PASSWORD=test homectl update -T --default-area=quux3 matchtest
-homectl inspect matchtest
-homectl inspect matchtest | grep "Area: quux3"
-homectl remove matchtest
-
-touch /testok
+run_testcases

From 43588dd63d6dc35b7eb2099da24d3cb47a033ac1 Mon Sep 17 00:00:00 2001
From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Tue, 25 Nov 2025 00:48:16 +0900
Subject: [PATCH 08/15] TEST-75-RESOLVED: move test cases for NFTSet= to
 TEST-07-PID1

The test cases are not related to systemd-resolved.

While moving the test cases, now userdbctl is used for obtaining UID/GID
for the dynamic user, as musl does not support nss module, hence getent
does not provide information about the dynamic user.
---
 test/units/TEST-07-PID1.nft.sh | 71 ++++++++++++++++++++++++++++++++++
 test/units/TEST-75-RESOLVED.sh | 58 +--------------------------
 2 files changed, 72 insertions(+), 57 deletions(-)
 create mode 100755 test/units/TEST-07-PID1.nft.sh

diff --git a/test/units/TEST-07-PID1.nft.sh b/test/units/TEST-07-PID1.nft.sh
new file mode 100755
index 0000000000..dbfefc281f
--- /dev/null
+++ b/test/units/TEST-07-PID1.nft.sh
@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
+set -eux
+set -o pipefail
+
+if ! command -v nft >/dev/null; then
+    echo "nftables is not installed. Skipped NFTSet= tests."
+    exit 0
+fi
+
+RUN_OUT="$(mktemp)"
+
+run() {
+    "$@" |& tee "$RUN_OUT"
+}
+
+nft add table inet sd_test
+nft add set inet sd_test c '{ type cgroupsv2; }'
+nft add set inet sd_test u '{ typeof meta skuid; }'
+nft add set inet sd_test g '{ typeof meta skgid; }'
+
+# service
+systemd-run --unit test-nft.service --service-type=exec -p DynamicUser=yes \
+            -p 'NFTSet=cgroup:inet:sd_test:c user:inet:sd_test:u group:inet:sd_test:g' sleep 10000
+run nft list set inet sd_test c
+grep -qF "test-nft.service" "$RUN_OUT"
+uid=$(userdbctl user --json=short test-nft | jq .uid)
+run nft list set inet sd_test u
+grep -qF "$uid" "$RUN_OUT"
+gid=$(userdbctl user --json=short test-nft | jq .gid)
+run nft list set inet sd_test g
+grep -qF "$gid" "$RUN_OUT"
+systemctl stop test-nft.service
+
+# scope
+run systemd-run --scope -u test-nft.scope -p 'NFTSet=cgroup:inet:sd_test:c' nft list set inet sd_test c
+grep -qF "test-nft.scope" "$RUN_OUT"
+
+mkdir -p /run/systemd/system
+# socket
+{
+    echo "[Socket]"
+    echo "ListenStream=12345"
+    echo "BindToDevice=lo"
+    echo "NFTSet=cgroup:inet:sd_test:c"
+} >/run/systemd/system/test-nft.socket
+{
+    echo "[Service]"
+    echo "ExecStart=sleep 10000"
+} >/run/systemd/system/test-nft.service
+systemctl daemon-reload
+systemctl start test-nft.socket
+systemctl status test-nft.socket
+run nft list set inet sd_test c
+grep -qF "test-nft.socket" "$RUN_OUT"
+systemctl stop test-nft.socket
+rm -f /run/systemd/system/test-nft.{socket,service}
+
+# slice
+mkdir /run/systemd/system/system.slice.d
+{
+    echo "[Slice]"
+    echo "NFTSet=cgroup:inet:sd_test:c"
+} >/run/systemd/system/system.slice.d/00-test-nft.conf
+systemctl daemon-reload
+run nft list set inet sd_test c
+grep -qF "system.slice" "$RUN_OUT"
+rm -rf /run/systemd/system/system.slice.d
+
+nft flush ruleset
+exit 0
diff --git a/test/units/TEST-75-RESOLVED.sh b/test/units/TEST-75-RESOLVED.sh
index a9504f5d1c..35ca98d07f 100755
--- a/test/units/TEST-75-RESOLVED.sh
+++ b/test/units/TEST-75-RESOLVED.sh
@@ -951,7 +951,7 @@ testcase_10_resolvectl_json() {
 # Test serve stale feature and NFTSet= if nftables is installed
 testcase_11_nft() {
     if ! command -v nft >/dev/null; then
-        echo "nftables is not installed. Skipped serve stale feature and NFTSet= tests."
+        echo "nftables is not installed. Skipped serve stale feature tests."
         return 0
     fi
 
@@ -1013,62 +1013,6 @@ testcase_11_nft() {
     grep -qE "NXDOMAIN" "$RUN_OUT"
 
     nft flush ruleset
-
-    ### NFTSet= test
-    nft add table inet sd_test
-    nft add set inet sd_test c '{ type cgroupsv2; }'
-    nft add set inet sd_test u '{ typeof meta skuid; }'
-    nft add set inet sd_test g '{ typeof meta skgid; }'
-
-    # service
-    systemd-run --unit test-nft.service --service-type=exec -p DynamicUser=yes \
-                -p 'NFTSet=cgroup:inet:sd_test:c user:inet:sd_test:u group:inet:sd_test:g' sleep 10000
-    run nft list set inet sd_test c
-    grep -qF "test-nft.service" "$RUN_OUT"
-    uid=$(getent passwd test-nft | cut -d':' -f3)
-    run nft list set inet sd_test u
-    grep -qF "$uid" "$RUN_OUT"
-    gid=$(getent passwd test-nft | cut -d':' -f4)
-    run nft list set inet sd_test g
-    grep -qF "$gid" "$RUN_OUT"
-    systemctl stop test-nft.service
-
-    # scope
-    run systemd-run --scope -u test-nft.scope -p 'NFTSet=cgroup:inet:sd_test:c' nft list set inet sd_test c
-    grep -qF "test-nft.scope" "$RUN_OUT"
-
-    mkdir -p /run/systemd/system
-    # socket
-    {
-        echo "[Socket]"
-        echo "ListenStream=12345"
-        echo "BindToDevice=lo"
-        echo "NFTSet=cgroup:inet:sd_test:c"
-    } >/run/systemd/system/test-nft.socket
-    {
-        echo "[Service]"
-        echo "ExecStart=sleep 10000"
-    } >/run/systemd/system/test-nft.service
-    systemctl daemon-reload
-    systemctl start test-nft.socket
-    systemctl status test-nft.socket
-    run nft list set inet sd_test c
-    grep -qF "test-nft.socket" "$RUN_OUT"
-    systemctl stop test-nft.socket
-    rm -f /run/systemd/system/test-nft.{socket,service}
-
-    # slice
-    mkdir /run/systemd/system/system.slice.d
-    {
-        echo "[Slice]"
-        echo "NFTSet=cgroup:inet:sd_test:c"
-    } >/run/systemd/system/system.slice.d/00-test-nft.conf
-    systemctl daemon-reload
-    run nft list set inet sd_test c
-    grep -qF "system.slice" "$RUN_OUT"
-    rm -rf /run/systemd/system/system.slice.d
-
-    nft flush ruleset
 }
 
 # Test resolvectl show-server-state

From 193626bd8bdb6a1dee7588ebd33f7ad36f84c932 Mon Sep 17 00:00:00 2001
From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Wed, 26 Nov 2025 01:47:30 +0900
Subject: [PATCH 09/15] test-network: also stop nftables.service

It is a firewall service used in postmarketOS.
When it is active, then e.g. DHCP packets are filtered, and many
tests will be failed.
---
 test/test-network/systemd-networkd-tests.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/test/test-network/systemd-networkd-tests.py b/test/test-network/systemd-networkd-tests.py
index beaefbdc89..c8c3bc1852 100755
--- a/test/test-network/systemd-networkd-tests.py
+++ b/test/test-network/systemd-networkd-tests.py
@@ -432,7 +432,8 @@ def save_active_units():
             'systemd-resolved-varlink.socket',
             'systemd-resolved.service',
             'systemd-timesyncd.service',
-            'firewalld.service'
+            'firewalld.service',
+            'nftables.service',
     ]:
         if call(f'systemctl is-active --quiet {u}') == 0:
             call(f'systemctl stop {u}')

From 8374085f2243296c38cd11b4ad50f6dd087696cb Mon Sep 17 00:00:00 2001
From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Wed, 26 Nov 2025 02:47:57 +0900
Subject: [PATCH 10/15] test-network: IPv4-mapped-IPv6 addresses may be shown
 as pure IPv6 address

It seems ip command built with musl always shows IPv6 addresses in the same way.
---
 test/test-network/systemd-networkd-tests.py | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/test/test-network/systemd-networkd-tests.py b/test/test-network/systemd-networkd-tests.py
index c8c3bc1852..abcd0b62c3 100755
--- a/test/test-network/systemd-networkd-tests.py
+++ b/test/test-network/systemd-networkd-tests.py
@@ -8923,7 +8923,7 @@ class NetworkdDHCPPDTests(unittest.TestCase, Utilities):
 
         self.teardown_nftset('addr6', 'network6', 'ifindex')
 
-    def verify_dhcp4_6rd(self, tunnel_name, address_prefix, border_router):
+    def verify_dhcp4_6rd(self, tunnel_name, address_prefix, address_prefix_re, border_router):
         print('### ip -4 address show dev veth-peer scope global')
         output = check_output('ip -4 address show dev veth-peer scope global')
         print(output)
@@ -9088,7 +9088,7 @@ class NetworkdDHCPPDTests(unittest.TestCase, Utilities):
         output = check_output(f'ip -6 address show dev {tunnel_name}')
         print(output)
         self.assertRegex(output, 'inet6 2001:db8:6464:[0-9a-f]+0[23]:[0-9a-f]*:[0-9a-f]*:[0-9a-f]*:[0-9a-f]*/64 (metric 256 |)scope global dynamic')
-        self.assertRegex(output, fr'inet6 ::{address_prefix}[0-9]+/96 scope global')
+        self.assertRegex(output, fr'inet6 ::{address_prefix_re}/96 scope global')
 
         print(f'### ip -6 route show dev {tunnel_name}')
         output = check_output(f'ip -6 route show dev {tunnel_name}')
@@ -9100,7 +9100,7 @@ class NetworkdDHCPPDTests(unittest.TestCase, Utilities):
         output = check_output('ip -6 route show default')
         print(output)
         self.assertIn('default', output)
-        self.assertIn(f'via ::{border_router} dev {tunnel_name}', output)
+        self.assertRegex(output, fr'via ::{border_router} dev {tunnel_name}')
 
     def test_dhcp4_6rd(self):
         def get_dhcp_6rd_prefix(link):
@@ -9160,13 +9160,13 @@ class NetworkdDHCPPDTests(unittest.TestCase, Utilities):
 
         self.wait_online(f'{tunnel_name}:routable')
 
-        self.verify_dhcp4_6rd(tunnel_name, '10.100.100.1', '10.0.0.1')
+        self.verify_dhcp4_6rd(tunnel_name, '10.100.100.1', '(10.100.100.1[0-9][0-9]|a64:64[6-9a-c][0-9a-f])', '(10.0.0.1|a00:1)')
 
         # Test case for reconfigure
         networkctl_reconfigure('dummy98', 'dummy99')
         self.wait_online('dummy98:routable', 'dummy99:degraded')
 
-        self.verify_dhcp4_6rd(tunnel_name, '10.100.100.1', '10.0.0.1')
+        self.verify_dhcp4_6rd(tunnel_name, '10.100.100.1', '(10.100.100.1[0-9][0-9]|a64:64[6-9a-c][0-9a-f])', '(10.0.0.1|a00:1)')
 
         # Change the address range and (border) router, then if check the same tunnel is reused.
         stop_dnsmasq()
@@ -9180,7 +9180,7 @@ class NetworkdDHCPPDTests(unittest.TestCase, Utilities):
         self.wait_online('veth99:routable', 'test1:routable', 'dummy97:routable', 'dummy98:routable', 'dummy99:degraded',
                          'veth97:routable', 'veth97-peer:routable', 'veth98:routable', 'veth98-peer:routable')
 
-        self.verify_dhcp4_6rd(tunnel_name, '10.100.100.2', '10.0.0.2')
+        self.verify_dhcp4_6rd(tunnel_name, '10.100.100.2', '(10.100.100.2[0-5][0-9]|a64:64[c-f][0-9a-f])', '(10.0.0.2|a00:2)')
 
 class NetworkdIPv6PrefixTests(unittest.TestCase, Utilities):
 

From 355bcc243ca30dd56ab142d5bfb5579c312192ca Mon Sep 17 00:00:00 2001
From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Sat, 27 Sep 2025 13:29:07 +0900
Subject: [PATCH 11/15] test: support coreutils built with
 --enable-single-binary=symlinks

Alpine/postmarketOS build coreutils with --enable-single-binary=symlinks.
In that case, all commands provided by coreutils are symlink to
/usr/bin/coreutils, and it calls prctl(PR_SET_NAME, argv[0]), hence the comm
will be the path to the symlink.

This also makes not kill sleep command with SIGKILL in TEST-17-UDEV, that is
totally unnecessary.
---
 src/test/test-execute.c                       |  6 +++
 .../TEST-17-UDEV/meson.build                  |  2 +-
 .../TEST-59-RELOADING-RESTART/meson.build     |  2 +-
 test/units/TEST-07-PID1.private-pids.sh       |  6 ++-
 .../TEST-17-UDEV.device_is_processing.sh      |  6 +--
 test/units/TEST-82-SOFTREBOOT.sh              | 38 ++++++++++++-------
 test/units/TEST-87-AUX-UTILS-VM.coredump.sh   |  7 +++-
 7 files changed, 46 insertions(+), 21 deletions(-)

diff --git a/src/test/test-execute.c b/src/test/test-execute.c
index 4c33474942..16476bc0d5 100644
--- a/src/test/test-execute.c
+++ b/src/test/test-execute.c
@@ -368,6 +368,12 @@ static void test_exec_workingdirectory(Manager *m) {
 }
 
 static void test_exec_execsearchpath(Manager *m) {
+        int r;
+
+        ASSERT_OK(r = is_symlink("/bin/ls"));
+        if (r > 0)
+                return (void) log_tests_skipped("/bin/ls is a symlink, maybe coreutils is built with --enable-single-binary=symlinks");
+
         ASSERT_OK(mkdir_p("/tmp/test-exec_execsearchpath", 0755));
 
         ASSERT_OK(copy_file("/bin/ls", "/tmp/test-exec_execsearchpath/ls_temp", 0,  0777, COPY_REPLACE));
diff --git a/test/integration-tests/TEST-17-UDEV/meson.build b/test/integration-tests/TEST-17-UDEV/meson.build
index 1d72c56e8c..58f809ba29 100644
--- a/test/integration-tests/TEST-17-UDEV/meson.build
+++ b/test/integration-tests/TEST-17-UDEV/meson.build
@@ -4,6 +4,6 @@ integration_tests += [
         integration_test_template + {
                 'name' : fs.name(meson.current_source_dir()),
                 'vm' : true,
-                'coredump-exclude-regex' : '/(sleep|udevadm)$',
+                'coredump-exclude-regex' : '/(coreutils|sleep|udevadm)$',
         },
 ]
diff --git a/test/integration-tests/TEST-59-RELOADING-RESTART/meson.build b/test/integration-tests/TEST-59-RELOADING-RESTART/meson.build
index 3d12024cef..f5fae753e2 100644
--- a/test/integration-tests/TEST-59-RELOADING-RESTART/meson.build
+++ b/test/integration-tests/TEST-59-RELOADING-RESTART/meson.build
@@ -3,6 +3,6 @@
 integration_tests += [
         integration_test_template + {
                 'name' : fs.name(meson.current_source_dir()),
-                'coredump-exclude-regex' : '/(sleep|bash|systemd-notify)$',
+                'coredump-exclude-regex' : '/(coreutils|sleep|bash|systemd-notify)$',
         },
 ]
diff --git a/test/units/TEST-07-PID1.private-pids.sh b/test/units/TEST-07-PID1.private-pids.sh
index 091535e3da..ae7e4538b3 100755
--- a/test/units/TEST-07-PID1.private-pids.sh
+++ b/test/units/TEST-07-PID1.private-pids.sh
@@ -50,7 +50,11 @@ testcase_basic() {
     systemd-run -p PrivatePIDs=yes --remain-after-exit --unit TEST-07-PID1-private-pid sleep infinity
     # Wait for ExecMainPID to be correctly populated as there might be a race between spawning service
     # and actual exec child process
-    timeout 10s bash -xec 'until [[ "$(cat /proc/$(systemctl show TEST-07-PID1-private-pid.service -p ExecMainPID --value)/comm)" == sleep ]]; do sleep .5; done'
+    # Note, Alpine/postmarketOS build coreutils with --enable-single-binary=symlinks. In that case, coreutils
+    # calls prctl(PR_SET_NAME, argv[0]), hence the comm will be the path to the symlink. If the sleep file is
+    # a dedicated binary (like most other distributions do), the comm will be the filename, i.e. "sleep". So,
+    # here we need to cut the directory part.
+    timeout 10s bash -xec 'until [[ "$(cat /proc/$(systemctl show TEST-07-PID1-private-pid.service -p ExecMainPID --value)/comm | sed -e "s|.*/||")" == sleep ]]; do sleep .5; done'
     pid=$(systemctl show TEST-07-PID1-private-pid.service -p ExecMainPID --value)
     kill -9 "$pid"
     timeout 10s bash -xec 'while [[ "$(systemctl show -P SubState TEST-07-PID1-private-pid.service)" != "failed" ]]; do sleep .5; done'
diff --git a/test/units/TEST-17-UDEV.device_is_processing.sh b/test/units/TEST-17-UDEV.device_is_processing.sh
index 7bdb5fc705..34fa126d82 100755
--- a/test/units/TEST-17-UDEV.device_is_processing.sh
+++ b/test/units/TEST-17-UDEV.device_is_processing.sh
@@ -15,9 +15,7 @@ at_exit() {
     systemctl stop testsleep.service
     rm -f /run/udev/udev.conf.d/timeout.conf
     rm -f /run/udev/rules.d/99-testsuite.rules
-    # Forcibly kills sleep command invoked by the udev rule before restarting,
-    # otherwise systemctl restart below will takes longer.
-    killall -KILL sleep
+    killall --regexp '(|/usr/bin/)sleep'
     udevadm control --reload
     ip link del "$IFNAME"
 }
@@ -62,7 +60,7 @@ done
 grep -q -F 'ID_PROCESSING=1' "/run/udev/data/n${IFINDEX}"
 
 # Forcibly kill sleep command invoked by the udev rule to finish processing the add event.
-killall sleep
+killall --regexp '(|/usr/bin/)sleep'
 udevadm settle --timeout=30
 
 # Check if ID_PROCESSING flag is unset, and the device units are active.
diff --git a/test/units/TEST-82-SOFTREBOOT.sh b/test/units/TEST-82-SOFTREBOOT.sh
index 274e54a117..378ac2a2a2 100755
--- a/test/units/TEST-82-SOFTREBOOT.sh
+++ b/test/units/TEST-82-SOFTREBOOT.sh
@@ -90,12 +90,16 @@ if [ -f /run/TEST-82-SOFTREBOOT.touch3 ]; then
 
     # Check that the surviving services are still around
     test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-survive.service)" = "active"
-    test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-survive-argv.service)" = "active"
+    if [[ ! -L $(command -v sleep) ]]; then
+        test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-survive-argv.service)" = "active"
+    fi
     test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-nosurvive-sigterm.service)" != "active"
     test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-nosurvive.service)" != "active"
 
     [[ ! -e /run/credentials/TEST-82-SOFTREBOOT-nosurvive.service ]]
-    assert_eq "$(cat /run/credentials/TEST-82-SOFTREBOOT-survive-argv.service/preserve)" "yay"
+    if [[ ! -L $(command -v sleep) ]]; then
+        assert_eq "$(cat /run/credentials/TEST-82-SOFTREBOOT-survive-argv.service/preserve)" "yay"
+    fi
 
     # There may be huge amount of pending messages in sockets. Processing them may cause journal rotation and
     # removal of old archived journal files. If a journal file is removed during journalctl reading it,
@@ -130,7 +134,9 @@ elif [ -f /run/TEST-82-SOFTREBOOT.touch2 ]; then
 
     # Check that the surviving services are still around
     test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-survive.service)" = "active"
-    test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-survive-argv.service)" = "active"
+    if [[ ! -L $(command -v sleep) ]]; then
+        test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-survive-argv.service)" = "active"
+    fi
     test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-nosurvive-sigterm.service)" != "active"
     test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-nosurvive.service)" != "active"
 
@@ -186,7 +192,9 @@ elif [ -f /run/TEST-82-SOFTREBOOT.touch ]; then
 
     # Check that the surviving services are still around
     test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-survive.service)" = "active"
-    test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-survive-argv.service)" = "active"
+    if [[ ! -L $(command -v sleep) ]]; then
+        test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-survive-argv.service)" = "active"
+    fi
     test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-nosurvive-sigterm.service)" != "active"
     test "$(systemctl show -P ActiveState TEST-82-SOFTREBOOT-nosurvive.service)" != "active"
 
@@ -272,15 +280,19 @@ EOF
     # '@', and the second will use SurviveFinalKillSignal=yes. Both should survive.
     # By writing to stdout, which is connected to the journal, we also ensure logging doesn't break across
     # soft reboots due to journald being temporarily stopped.
-    systemd-run --service-type=notify --unit=TEST-82-SOFTREBOOT-survive-argv.service \
-        --property SurviveFinalKillSignal=no \
-        --property IgnoreOnIsolate=yes \
-        --property DefaultDependencies=no \
-        --property After=basic.target \
-        --property "Conflicts=reboot.target kexec.target poweroff.target halt.target emergency.target rescue.target" \
-        --property "Before=reboot.target kexec.target poweroff.target halt.target emergency.target rescue.target" \
-        --property SetCredential=preserve:yay \
-         "$survive_argv"
+    # Note, when coreutils is built with --enable-single-binary=symlinks, unfortunately we cannot freely rename
+    # sleep command, hence we cannot test the feature.
+    if [[ ! -L $(command -v sleep) ]]; then
+        systemd-run --service-type=notify --unit=TEST-82-SOFTREBOOT-survive-argv.service \
+            --property SurviveFinalKillSignal=no \
+            --property IgnoreOnIsolate=yes \
+            --property DefaultDependencies=no \
+            --property After=basic.target \
+            --property "Conflicts=reboot.target kexec.target poweroff.target halt.target emergency.target rescue.target" \
+            --property "Before=reboot.target kexec.target poweroff.target halt.target emergency.target rescue.target" \
+            --property SetCredential=preserve:yay \
+            "$survive_argv"
+    fi
     # shellcheck disable=SC2016
     systemd-run --service-type=exec --unit=TEST-82-SOFTREBOOT-survive.service \
         --property TemporaryFileSystem="/run /tmp /var" \
diff --git a/test/units/TEST-87-AUX-UTILS-VM.coredump.sh b/test/units/TEST-87-AUX-UTILS-VM.coredump.sh
index 19f0fa280e..1b37197bde 100755
--- a/test/units/TEST-87-AUX-UTILS-VM.coredump.sh
+++ b/test/units/TEST-87-AUX-UTILS-VM.coredump.sh
@@ -4,7 +4,12 @@ set -eux
 set -o pipefail
 
 # shellcheck source=test/units/util.sh
- . "$(dirname "$0")"/util.sh
+. "$(dirname "$0")"/util.sh
+
+if [[ -L $(command -v sleep) ]]; then
+    # coreutils is built with --enable-single-binary=symlinks, and we cannot rename it.
+    exit 0
+fi
 
 # Make sure the binary name fits into 15 characters
 CORE_TEST_BIN="/tmp/test-dump"

From 9fafe89bcc91550f55a96f66972406ce678be2fb Mon Sep 17 00:00:00 2001
From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Fri, 28 Nov 2025 23:27:26 +0900
Subject: [PATCH 12/15] integration-test: skip several test cases on
 Alpine/postmarketOS

---
 test/units/TEST-46-HOMED.sh           | 12 ++++++++++++
 test/units/TEST-50-DISSECT.dissect.sh |  8 ++++++++
 test/units/TEST-64-UDEV-STORAGE.sh    | 10 ++++++++--
 test/units/TEST-67-INTEGRITY.sh       | 14 ++++++++++++++
 test/units/TEST-70-TPM2.tpm2-setup.sh | 10 ++++++++++
 test/units/TEST-75-RESOLVED.sh        |  6 ++++++
 test/units/TEST-89-RESOLVED-MDNS.sh   |  6 ++++++
 7 files changed, 64 insertions(+), 2 deletions(-)

diff --git a/test/units/TEST-46-HOMED.sh b/test/units/TEST-46-HOMED.sh
index b18e05f153..e7ea574093 100755
--- a/test/units/TEST-46-HOMED.sh
+++ b/test/units/TEST-46-HOMED.sh
@@ -52,6 +52,12 @@ systemctl kill -sUSR1 systemd-homed
 testcase_basic() {
     local TMP_SKEL
 
+    . /etc/os-release
+    if [[ "${ID_LIKE:-}" == alpine ]] && ! systemd-detect-virt -cq; then
+        # luks seems to be broken on alpine/postmarketos.
+        return 0
+    fi
+
     TMP_SKEL=$(mktemp -d)
     echo hogehoge >"$TMP_SKEL"/hoge
 
@@ -237,6 +243,12 @@ testcase_basic() {
 }
 
 testcase_blob() {
+    . /etc/os-release
+    if [[ "${ID_LIKE:-}" == alpine ]] && ! systemd-detect-virt -cq; then
+        # luks seems to be broken on alpine/postmarketos.
+        return 0
+    fi
+
     # blob directory tests
     # See docs/USER_RECORD_BLOB_DIRS.md
     checkblob() {
diff --git a/test/units/TEST-50-DISSECT.dissect.sh b/test/units/TEST-50-DISSECT.dissect.sh
index bf45489545..5bd95fbe0d 100755
--- a/test/units/TEST-50-DISSECT.dissect.sh
+++ b/test/units/TEST-50-DISSECT.dissect.sh
@@ -9,6 +9,14 @@ set -o pipefail
 # shellcheck source=test/units/util.sh
 . "$(dirname "$0")"/util.sh
 
+. /etc/os-release
+if [[ "${ID_LIKE:-}" == alpine ]]; then
+    # Alpine/postmarketOS builds libdevmapper and so on without systemd support, and seems to not wait for
+    # uevents for dm-X devices being processed by systemd-udevd. That causes a significant issue in
+    # dissect-image.c especially when multiple dm-X devices are activated/deactivated in parallel.
+    exit 0
+fi
+
 systemd-dissect --json=short "$MINIMAL_IMAGE.raw" | \
     grep -q -F '{"rw":"ro","designator":"root","partition_uuid":null,"partition_label":null,"fstype":"squashfs","architecture":null,"verity":"external"'
 systemd-dissect "$MINIMAL_IMAGE.raw" | grep -q -F "MARKER=1"
diff --git a/test/units/TEST-64-UDEV-STORAGE.sh b/test/units/TEST-64-UDEV-STORAGE.sh
index 88c89c5191..5956e14aec 100755
--- a/test/units/TEST-64-UDEV-STORAGE.sh
+++ b/test/units/TEST-64-UDEV-STORAGE.sh
@@ -266,6 +266,12 @@ EOF
 testcase_multipath_basic_failover() {
     local dmpath i path wwid
 
+    . /etc/os-release
+    if [[ "${ID_LIKE:-}" == "alpine" ]]; then
+        echo "multipath on alpine/postmarketos is broken, skipping the test" | tee --append /skipped
+        exit 77
+    fi
+
     # Configure multipath
     cat >/etc/multipath.conf <<\EOF
 defaults {
@@ -631,8 +637,8 @@ testcase_lvm_basic() {
     )
 
     . /etc/os-release
-    if [[ "$ID" == "ubuntu" ]]; then
-        echo "LVM on Ubuntu is broken, skipping the test" | tee --append /skipped
+    if [[ "$ID" == "ubuntu" || "${ID_LIKE:-}" == "alpine" ]]; then
+        echo "LVM on Ubuntu/alpine/postmarketos is broken, skipping the test" | tee --append /skipped
         exit 77
     fi
 
diff --git a/test/units/TEST-67-INTEGRITY.sh b/test/units/TEST-67-INTEGRITY.sh
index c015703666..0919f20248 100755
--- a/test/units/TEST-67-INTEGRITY.sh
+++ b/test/units/TEST-67-INTEGRITY.sh
@@ -2,6 +2,8 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 set -euxo pipefail
 
+. /etc/os-release
+
 DM_NAME="integrity_test"
 DM_NODE="/dev/mapper/${DM_NAME}"
 DM_SERVICE="systemd-integritysetup@${DM_NAME}.service"
@@ -117,6 +119,18 @@ EOF
 }
 
 for a in crc32c crc32 xxhash64 sha1 sha256; do
+    if [[ "$a" == crc32 && "${ID_LIKE:-}" == alpine ]]; then
+        # crc32 is not supported on alpine/postmarketos ??
+        # --------
+        # [   22.419458] TEST-67-INTEGRITY.sh[3085]: + integritysetup format /dev/loop0 --batch-mode -I crc32 ''
+        # [   22.433168] kernel: device-mapper: table: 253:0: integrity: Invalid internal hash (-ENOENT)
+        # [   22.433220] TEST-67-INTEGRITY.sh[3475]: device-mapper: reload ioctl on temporary-cryptsetup-6b3b80ef-6854-4102-8239-6360f15af0c3 (253:0) failed: No such file or directory
+        # [   22.433220] TEST-67-INTEGRITY.sh[3475]: Cannot format integrity for device /dev/loop0.
+        # [   22.433835] kernel: device-mapper: ioctl: error adding target to table
+        # --------
+        continue;
+    fi
+
     test_one "$a" 0
     test_one "$a" 1
 done
diff --git a/test/units/TEST-70-TPM2.tpm2-setup.sh b/test/units/TEST-70-TPM2.tpm2-setup.sh
index 72f7841858..23cb85e30b 100755
--- a/test/units/TEST-70-TPM2.tpm2-setup.sh
+++ b/test/units/TEST-70-TPM2.tpm2-setup.sh
@@ -11,6 +11,16 @@ if [[ ! -x "${SD_TPM2SETUP:?}" ]]; then
     exit 0
 fi
 
+. /etc/os-release
+if [[ "${ID_LIKE:-}" == alpine ]]; then
+    # For some unknown reasons, the test fails with the following:
+    # --------
+    # Couldn't find signature for this PCR bank, PCR index and public key.
+    # Failed to unseal secret using TPM2: No such device or address
+    # --------
+    exit 0
+fi
+
 "$SD_TPM2SETUP" --help
 "$SD_TPM2SETUP" --version
 "$SD_TPM2SETUP" --tpm2-device=list
diff --git a/test/units/TEST-75-RESOLVED.sh b/test/units/TEST-75-RESOLVED.sh
index 35ca98d07f..51820016dd 100755
--- a/test/units/TEST-75-RESOLVED.sh
+++ b/test/units/TEST-75-RESOLVED.sh
@@ -979,6 +979,12 @@ testcase_11_nft() {
     grep -qE "no servers could be reached" "$RUN_OUT"
     nft flush ruleset
 
+    . /etc/os-release
+    if [[ "${ID_LIKE:-}" == alpine ]]; then
+        # FIXME: For some reasons, the following tests will fail on alpine/postmarketos.
+        return 0
+    fi
+
     ### Test TIMEOUT with serve stale feature ###
 
     mkdir -p /run/systemd/resolved.conf.d
diff --git a/test/units/TEST-89-RESOLVED-MDNS.sh b/test/units/TEST-89-RESOLVED-MDNS.sh
index a7062b813a..ae18cd49e8 100755
--- a/test/units/TEST-89-RESOLVED-MDNS.sh
+++ b/test/units/TEST-89-RESOLVED-MDNS.sh
@@ -6,6 +6,12 @@ set -o pipefail
 # shellcheck source=test/units/test-control.sh
 . "$(dirname "$0")"/test-control.sh
 
+. /etc/os-release
+if [[ "${ID_LIKE:-}" == alpine ]]; then
+    # FIXME: For some reasons (maybe this test requires nss module??), the test fails on alpine/postmarketos.
+    exit 77
+fi
+
 SERVICE_TYPE_COUNT=10
 SERVICE_COUNT=20
 CONTAINER_ZONE="test-$RANDOM"

From f117629f2841bf503d7e2363f34578d01db9e788 Mon Sep 17 00:00:00 2001
From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Sat, 29 Nov 2025 10:01:56 +0900
Subject: [PATCH 13/15] test: skip several test cases when built with musl

---
 src/test/test-execute.c         |  4 ++++
 test/units/TEST-02-UNITTESTS.sh | 11 +++++++++++
 test/units/TEST-46-HOMED.sh     |  7 +++++++
 test/units/TEST-65-ANALYZE.sh   |  8 ++++++--
 test/units/util.sh              |  5 +++++
 5 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/src/test/test-execute.c b/src/test/test-execute.c
index 16476bc0d5..d5b7e3416c 100644
--- a/src/test/test-execute.c
+++ b/src/test/test-execute.c
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include <fnmatch.h>
+#include <gnu/libc-version.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <sys/mount.h>
@@ -1176,6 +1177,9 @@ static void test_exec_capabilityboundingset(Manager *m) {
 }
 
 static void test_exec_basic(Manager *m) {
+        if (isempty(gnu_get_libc_version()))
+                return (void) log_tests_skipped("ConditionVersion=glibc will not pass under musl");
+
         if (MANAGER_IS_SYSTEM(m) || have_userns_privileges())
                 test(m, "exec-basic.service", can_unshare || MANAGER_IS_SYSTEM(m) ? 0 : EXIT_NAMESPACE, CLD_EXITED);
         else
diff --git a/test/units/TEST-02-UNITTESTS.sh b/test/units/TEST-02-UNITTESTS.sh
index dec727f804..ee5eab08d5 100755
--- a/test/units/TEST-02-UNITTESTS.sh
+++ b/test/units/TEST-02-UNITTESTS.sh
@@ -3,12 +3,22 @@
 set -eux
 set -o pipefail
 
+# shellcheck source=test/units/util.sh
+. "$(dirname "$0")"/util.sh
+
 if ! systemd-detect-virt -qc && [[ "${TEST_CMDLINE_NEWLINE:-}" != bar ]]; then
     cat /proc/cmdline
     echo >&2 "Expected TEST_CMDLINE_NEWLINE=bar from the kernel command line"
     exit 1
 fi
 
+if built_with_musl; then
+    SYSTEMD_LIBC=musl
+else
+    SYSTEMD_LIBC=glibc
+fi
+export SYSTEMD_LIBC
+
 if [[ -z "${TEST_MATCH_SUBTEST:-}" ]]; then
     # If we're running with TEST_PREFER_NSPAWN=1 limit the set of tests we run
     # in QEMU to only those that can't run in a container to avoid running
@@ -66,6 +76,7 @@ run_test() {
         --property Delegate=1 \
         --property EnvironmentFile=-/usr/lib/systemd/systemd-asan-env \
         --property "Environment=$environment" \
+        --setenv SYSTEMD_LIBC \
         --unit="$name" \
         --wait "$test" && ret=0 || ret=$?
 
diff --git a/test/units/TEST-46-HOMED.sh b/test/units/TEST-46-HOMED.sh
index e7ea574093..bb6d64bfed 100755
--- a/test/units/TEST-46-HOMED.sh
+++ b/test/units/TEST-46-HOMED.sh
@@ -6,6 +6,8 @@ set -o pipefail
 
 # shellcheck source=test/units/test-control.sh
 . "$(dirname "$0")"/test-control.sh
+# shellcheck source=test/units/util.sh
+. "$(dirname "$0")"/util.sh
 
 # Check if homectl is installed, and if it isn't bail out early instead of failing
 if ! command -v homectl >/dev/null; then
@@ -786,6 +788,11 @@ testcase_sign() {
     homectl list-signing-keys | grep -q local.public
     (! (homectl list-signing-keys | grep -q signtest.public))
 
+    if built_with_musl; then
+        # FIXME: musl does not support yescrypt. Use SHA512 and update signature.
+        return 0
+    fi
+
     print_identity() {
         cat <<\EOF
 {
diff --git a/test/units/TEST-65-ANALYZE.sh b/test/units/TEST-65-ANALYZE.sh
index 929796751d..af73c7dc7c 100755
--- a/test/units/TEST-65-ANALYZE.sh
+++ b/test/units/TEST-65-ANALYZE.sh
@@ -79,8 +79,12 @@ systemd-analyze dump "*.socket" "*.service" aaaaaaa ... >/dev/null
 systemd-analyze dump systemd-journald.service >/dev/null
 (! systemd-analyze dump "")
 (! systemd-analyze dump --global systemd-journald.service)
-# malloc
-systemd-analyze malloc >/dev/null
+# malloc (supported only when built with glibc)
+if built_with_musl; then
+    (! systemd-analyze malloc)
+else
+    systemd-analyze malloc >/dev/null
+fi
 (! systemd-analyze malloc --global)
 # unit-files
 systemd-analyze unit-files >/dev/null
diff --git a/test/units/util.sh b/test/units/util.sh
index d07364922f..445b71836a 100755
--- a/test/units/util.sh
+++ b/test/units/util.sh
@@ -453,3 +453,8 @@ generate_locale() {
         locale-gen "$locale"
     fi
 }
+
+built_with_musl() (
+    set +ex
+    ! systemd-analyze --quiet condition 'ConditionVersion=glibc $= ?*'
+)

From d5932060ed8b63a16170044d580ab732a2d34bd9 Mon Sep 17 00:00:00 2001
From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Sat, 29 Nov 2025 10:02:19 +0900
Subject: [PATCH 14/15] integration-test: skip several test cases when nss
 module is not supported

---
 test/units/TEST-13-NSPAWN.nss-mymachines.sh |  4 +++
 test/units/TEST-46-HOMED.sh                 | 37 +++++++++++++++++----
 test/units/TEST-71-HOSTNAME.sh              |  5 ++-
 test/units/TEST-74-AUX-UTILS.capsule.sh     |  7 ++++
 test/units/TEST-75-RESOLVED.sh              | 13 ++++++++
 test/units/util.sh                          | 34 +++++++++++++++++++
 6 files changed, 92 insertions(+), 8 deletions(-)

diff --git a/test/units/TEST-13-NSPAWN.nss-mymachines.sh b/test/units/TEST-13-NSPAWN.nss-mymachines.sh
index a14c53154c..e4a9616712 100755
--- a/test/units/TEST-13-NSPAWN.nss-mymachines.sh
+++ b/test/units/TEST-13-NSPAWN.nss-mymachines.sh
@@ -7,6 +7,10 @@ set -o pipefail
 # shellcheck source=test/units/util.sh
 . "$(dirname "$0")"/util.sh
 
+if ! check_nss_module mymachine; then
+    exit 0
+fi
+
 at_exit() {
     set +e
 
diff --git a/test/units/TEST-46-HOMED.sh b/test/units/TEST-46-HOMED.sh
index bb6d64bfed..d7d29e0893 100755
--- a/test/units/TEST-46-HOMED.sh
+++ b/test/units/TEST-46-HOMED.sh
@@ -233,7 +233,13 @@ testcase_basic() {
     PASSWORD=xEhErW0ndafV4s homectl with test-user -- rm /home/test-user/xyz
     PASSWORD=xEhErW0ndafV4s homectl with test-user -- test ! -f /home/test-user/xyz
     (! PASSWORD=xEhErW0ndafV4s homectl with test-user -- test -f /home/test-user/xyz)
-    [[ "$(PASSWORD=xEhErW0ndafV4s homectl with test-user -- stat -c %U /home/test-user/hoge)" == "test-user" ]]
+    if check_nss_module systemd; then
+        [[ "$(PASSWORD=xEhErW0ndafV4s homectl with test-user -- stat -c %U /home/test-user/hoge)" == "test-user" ]]
+        [[ "$(PASSWORD=xEhErW0ndafV4s homectl with test-user -- stat -c %u /home/test-user/hoge)" == "$(id -u test-user)" ]]
+    fi
+    # The machine ID may start with a numeric, and in that case the field name must be quoted.
+    [[ "$(PASSWORD=xEhErW0ndafV4s homectl with test-user -- stat -c %u /home/test-user/hoge)" == \
+       "$(homectl inspect --json=short test-user | jq .binding.\""$(cat /etc/machine-id)"\".uid)" ]]
     [[ "$(PASSWORD=xEhErW0ndafV4s homectl with test-user -- cat /home/test-user/hoge)" == "$(cat "$TMP_SKEL"/hoge)" ]]
 
     # Regression tests
@@ -587,6 +593,11 @@ testcase_ssh() {
         return 0
     fi
 
+    # 'ssh homedsshtest@localhost' requires systemd NSS module.
+    if ! check_nss_module systemd; then
+        return 0
+    fi
+
     if ! command -v ssh >/dev/null || ! command -v sshd >/dev/null; then
         echo "ssh/sshd is not installed, skipping the ssh test."
         return 0
@@ -690,17 +701,24 @@ testcase_alias() {
     userdbctl user aliastest2@myrealm
     userdbctl user aliastest3@myrealm
 
-    getent passwd aliastest
-    getent passwd aliastest2
-    getent passwd aliastest3
-    getent passwd aliastest@myrealm
-    getent passwd aliastest2@myrealm
-    getent passwd aliastest3@myrealm
+    if check_nss_module systemd; then
+        getent passwd aliastest
+        getent passwd aliastest2
+        getent passwd aliastest3
+        getent passwd aliastest@myrealm
+        getent passwd aliastest2@myrealm
+        getent passwd aliastest3@myrealm
+    fi
 
     homectl remove aliastest
 }
 
 testcase_quota() {
+    # 'run0 -u' requires systemd NSS module.
+    if ! check_nss_module systemd; then
+        return 0
+    fi
+
     NEWPASSWORD=quux homectl create tmpfsquota --storage=subvolume --dev-shm-limit=50K --tmp-limit=50K -P
     for p in /dev/shm /tmp; do
         if findmnt -n -o options "$p" | grep -q usrquota; then
@@ -725,6 +743,11 @@ testcase_quota() {
 }
 
 testcase_subarea() {
+    # 'run0 -u' requires systemd NSS module.
+    if ! check_nss_module systemd; then
+        return 0
+    fi
+
     NEWPASSWORD=quux homectl create subareatest --storage=subvolume -P
     run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest mkdir Areas
     run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u subareatest cp -av /etc/skel Areas/furb
diff --git a/test/units/TEST-71-HOSTNAME.sh b/test/units/TEST-71-HOSTNAME.sh
index 8ec3bd6cfb..ffb110be68 100755
--- a/test/units/TEST-71-HOSTNAME.sh
+++ b/test/units/TEST-71-HOSTNAME.sh
@@ -166,6 +166,10 @@ testcase_hardware_serial() {
 testcase_nss-myhostname() {
     local database host i
 
+    if ! check_nss_module myhostname; then
+        return 0
+    fi
+
     HOSTNAME="$(hostnamectl hostname)"
 
     # Set up a dummy network for _gateway and _outbound labels
@@ -316,7 +320,6 @@ EOF
     assert_in "CHASSIS=watch" "$(cat /run/alternate-path/mymachine-info)"
 }
 
-
 run_testcases
 
 touch /testok
diff --git a/test/units/TEST-74-AUX-UTILS.capsule.sh b/test/units/TEST-74-AUX-UTILS.capsule.sh
index 06f6a1ca6e..c2c3073ea8 100755
--- a/test/units/TEST-74-AUX-UTILS.capsule.sh
+++ b/test/units/TEST-74-AUX-UTILS.capsule.sh
@@ -4,6 +4,13 @@
 set -eux
 set -o pipefail
 
+# shellcheck source=test/units/util.sh
+. "$(dirname "$0")"/util.sh
+
+if ! check_nss_module systemd; then
+    exit 0
+fi
+
 at_exit() {
     set +e
     systemctl --no-block stop capsule@foobar.service
diff --git a/test/units/TEST-75-RESOLVED.sh b/test/units/TEST-75-RESOLVED.sh
index 51820016dd..5ec588309b 100755
--- a/test/units/TEST-75-RESOLVED.sh
+++ b/test/units/TEST-75-RESOLVED.sh
@@ -408,6 +408,11 @@ manual_testcase_02_mdns_llmnr() {
 
 testcase_03_23951() {
     : "--- nss-resolve/nss-myhostname tests"
+
+    if ! check_nss_module resolve; then
+        return 0
+    fi
+
     # Sanity check
     TIMESTAMP=$(date '+%F %T')
     # Issue: https://github.com/systemd/systemd/issues/23951
@@ -426,6 +431,10 @@ testcase_03_23951() {
 }
 
 testcase_04_18812() {
+    if ! check_nss_module resolve; then
+        return 0
+    fi
+
     # Issue: https://github.com/systemd/systemd/issues/18812
     # PR: https://github.com/systemd/systemd/pull/18896
     # Follow-up issue: https://github.com/systemd/systemd/issues/23152
@@ -446,6 +455,10 @@ testcase_04_18812() {
 }
 
 testcase_05_25088() {
+    if ! check_nss_module resolve; then
+        return 0
+    fi
+
     # Issue: https://github.com/systemd/systemd/issues/25088
     run getent -s resolve hosts 127.128.0.5
     grep -qEx '127\.128\.0\.5\s+localhost5(\s+localhost5?\.localdomain[45]?){4}' "$RUN_OUT"
diff --git a/test/units/util.sh b/test/units/util.sh
index 445b71836a..c62f8d9574 100755
--- a/test/units/util.sh
+++ b/test/units/util.sh
@@ -458,3 +458,37 @@ built_with_musl() (
     set +ex
     ! systemd-analyze --quiet condition 'ConditionVersion=glibc $= ?*'
 )
+
+check_nss_module() (
+    set +e
+
+    local name="${1:?}"
+    local have=
+    local i
+
+    if [[ ! -e /etc/nsswitch.conf ]]; then
+        : "/etc/nsswitch.conf not found."
+        return 1
+    fi
+
+    if ! find /usr/lib* -name "libnss_${name}.so.*" 2>/dev/null | grep . >/dev/null; then
+        : "NSS module $name not found."
+        return 1
+    fi
+
+    if [[ "$name" == systemd ]]; then
+        for i in passwd group shadow; do
+            if ! grep -qE "^$i:.*[[:space:]]*systemd" /etc/nsswitch.conf; then
+                : "systemd NSS module is not enabled for $i database."
+                return 1
+            fi
+        done
+    else
+        if ! grep -qE "^hosts:.*[[:space:]]*$name" /etc/nsswitch.conf; then
+            : "$name NSS module is not enabled for hosts database."
+            return 1
+        fi
+    fi
+
+    return 0
+)

From e7e3c23bbb1c6f43b440464afdaa13b183d2e8db Mon Sep 17 00:00:00 2001
From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Wed, 3 Dec 2025 06:59:31 +0900
Subject: [PATCH 15/15] test-execute: support case that the games user in
 multiple groups

On Alpine/postmarketOS,
```
$ id -nG games
games users
```
---
 test/test-execute/exec-dynamicuser-fixeduser-games.service | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/test/test-execute/exec-dynamicuser-fixeduser-games.service b/test/test-execute/exec-dynamicuser-fixeduser-games.service
index 29b712c9aa..6043589745 100644
--- a/test/test-execute/exec-dynamicuser-fixeduser-games.service
+++ b/test/test-execute/exec-dynamicuser-fixeduser-games.service
@@ -2,12 +2,13 @@
 [Unit]
 Description=Test DynamicUser with static User= whose uid and gid are different
 # On Ubuntu or Debian, user games has uid==5 and gid==60.
+# On Alpine/postmarketOS, the user 'games' in the 'games' and 'users' groups.
 
 [Service]
 Type=oneshot
-ExecStart=bash -x -c 'test "$$(id -nG)" = "games" && test "$$(id -ng)" = "games" && test "$$(id -nu)" = "games"'
+ExecStart=bash -x -c '[[ "$$(id -nG)" =~ "games" ]] && test "$$(id -ng)" = "games" && test "$$(id -nu)" = "games"'
 # Multiple ExecStart= lines causes the issue #9702.
-ExecStart=bash -x -c 'test "$$(id -nG)" = "games" && test "$$(id -ng)" = "games" && test "$$(id -nu)" = "games"'
+ExecStart=bash -x -c '[[ "$$(id -nG)" =~ "games" ]] && test "$$(id -ng)" = "games" && test "$$(id -nu)" = "games"'
 DynamicUser=yes
 User=games
 ReadWritePaths=-/coverage