diff --git a/modules/netns-isolation.nix b/modules/netns-isolation.nix
index 683331b..1f83186 100644
--- a/modules/netns-isolation.nix
+++ b/modules/netns-isolation.nix
@@ -37,7 +37,6 @@ let
       type = types.str;
       description = ''
         User that is allowed to execute commands in the service network namespaces.
-        The user's group is also authorized.
       '';
       default = config.nix-bitcoin.operator.name;
     };
@@ -122,8 +121,10 @@ in {
       source = config.nix-bitcoin.pkgs.netns-exec;
       capabilities = "cap_sys_admin=ep";
       owner = cfg.allowedUser;
-      group = ""; # Set to the group of `owner`
-      permissions = "550";
+      # Don't authorize the group of `owner`. For normal users, this group is
+      # `users`, which is shared by all normal users.
+      group = "root";
+      permissions = "500";
     };
 
     systemd.services = {
diff --git a/test/tests.nix b/test/tests.nix
index 53c01d4..1c0eaad 100644
--- a/test/tests.nix
+++ b/test/tests.nix
@@ -279,6 +279,10 @@ let
       test.data.netns = config.nix-bitcoin.netns-isolation.netns;
       tests.netns-isolation = true;
       environment.systemPackages = [ pkgs.fping ];
+
+      # Used for testing that `netns-exec` is not executable by users other than
+      # the operator. Like all normal users, this user is a member of group `users`.
+      users.users.unauthorized.isNormalUser = true;
     };
 
     regtestBase = { config, pkgs, ... }: {
diff --git a/test/tests.py b/test/tests.py
index 3509f4b..cee5ca2 100644
--- a/test/tests.py
+++ b/test/tests.py
@@ -331,6 +331,21 @@ def _():
         f"nc -l {ip('bitcoind')} 1080 2>&1 || true", "nc: Cannot assign requested address"
     )
 
+    # netns-exec should fail for unauthorized namespaces
+    assert_matches(
+        "runuser -u operator -- netns-exec nb-clightning ip a 2>&1 || true",
+        "nb-clightning is not an allowed netns",
+    )
+
+    # netns-exec should only be executable by the operator user.
+    # User `unauthorized` is a member of group `users`, like all normal users.
+    # Netns `nb-clightning` is rejected by netns-exec before it accesses the
+    # netns, so the error below can only originate from the exec permissions.
+    assert_matches(
+        "runuser -u unauthorized -- netns-exec nb-clightning ip a 2>&1 || true",
+        "Permission denied",
+    )
+
     if "joinmarket" in enabled_tests:
         # netns-exec should drop capabilities
         assert_matches(
@@ -338,13 +353,6 @@ def _():
             re.compile("^Current: =$", re.MULTILINE),
         )
 
-    if "clightning" in enabled_tests:
-        # netns-exec should fail for unauthorized namespaces
-        machine.fail("netns-exec nb-clightning ip a")
-
-        # netns-exec should only be executable by the operator user
-        machine.fail("runuser -u clightning -- netns-exec nb-bitcoind ip a")
-
 
 # Impure: stops bitcoind (and dependent services)
 @test("backups")