diff --git a/minimal/postprocess-conf.yaml b/minimal/postprocess-conf.yaml
index 6b54a77..b1f6f95 100644
--- a/minimal/postprocess-conf.yaml
+++ b/minimal/postprocess-conf.yaml
@@ -14,9 +14,14 @@ ignore-removed-users:
   - root
 ignore-removed-groups:
   - root
+# By default users and groups are injected to nss-altfiles
+# which is immutable. This list moves a selected set
+# to /etc/group instead, which is mutable per system
+# and allows local users to become part of these groups.
 etc-group-members:
   - wheel
   - systemd-journal
+  - tss # https://issues.redhat.com/browse/BIFROST-618
   - adm
 
 check-passwd:
diff --git a/tests/rootfs/cases/etc-group b/tests/rootfs/cases/etc-group
new file mode 100755
index 0000000..fceee84
--- /dev/null
+++ b/tests/rootfs/cases/etc-group
@@ -0,0 +1,6 @@
+#!/bin/bash
+set -xeuo pipefail
+# Verify group members
+getent group tss >/dev/null
+# This one needs to be in /etc
+grep -q tss /etc/group