diff --git a/infra/image/shdefaults b/infra/image/shdefaults
index b5768cca..b2983f4f 100644
--- a/infra/image/shdefaults
+++ b/infra/image/shdefaults
@@ -6,4 +6,6 @@
 CAP_DEFAULTS=(
     "+DAC_READ_SEARCH"  # Required for SSSD
     "+SYS_PTRACE"       # Required for debugging
+    "+SYS_ADMIN"        # Required to make dbus-brokder for systemd 258 work
+                        # Should be "+AUDIT_WRITE", "+SETUID", "+SETGID"
 )