diff --git a/src/shared/cgroup-util.c b/src/shared/cgroup-util.c
index c5a5f8df83..43c415d760 100644
--- a/src/shared/cgroup-util.c
+++ b/src/shared/cgroup-util.c
@@ -1527,7 +1527,12 @@ char *cg_escape(const char *p) {
         /* The return value of this function (unlike cg_unescape())
          * needs free()! */
 
-        if (p[0] == '_' || streq(p, "notify_on_release") || streq(p, "release_agent") || streq(p, "tasks"))
+        if (p[0] == 0 ||
+            p[0] == '_' ||
+            p[0] == '.' ||
+            streq(p, "notify_on_release") ||
+            streq(p, "release_agent") ||
+            streq(p, "tasks"))
                 need_prefix = true;
         else {
                 const char *dot;
diff --git a/src/test/test-cgroup-util.c b/src/test/test-cgroup-util.c
index cc1a6fd723..c9634d42b0 100644
--- a/src/test/test-cgroup-util.c
+++ b/src/test/test-cgroup-util.c
@@ -146,11 +146,15 @@ static void test_escape_one(const char *s, const char *r) {
 
 static void test_escape(void) {
         test_escape_one("foobar", "foobar");
+        test_escape_one(".foobar", "_.foobar");
         test_escape_one("foobar.service", "foobar.service");
         test_escape_one("cgroup.service", "_cgroup.service");
         test_escape_one("cpu.service", "_cpu.service");
         test_escape_one("tasks", "_tasks");
         test_escape_one("_foobar", "__foobar");
+        test_escape_one("", "_");
+        test_escape_one("_", "__");
+        test_escape_one(".", "_.");
 }
 
 static void test_controller_is_valid(void) {