diff --git a/src/sysusers/sysusers.c b/src/sysusers/sysusers.c
index 5dcc213b17..43952e5f19 100644
--- a/src/sysusers/sysusers.c
+++ b/src/sysusers/sysusers.c
@@ -429,11 +429,12 @@ static int write_temporary_passwd(const char *passwd_path, FILE **tmpfile, char
                                 return -EEXIST;
                         }
 
+                        errno = 0;
+
                         /* Make sure we keep the NIS entries (if any) at the end. */
                         if (IN_SET(pw->pw_name[0], '+', '-'))
                                 break;
 
-                        errno = 0;
                         if (putpwent(pw, passwd) < 0)
                                 return errno ? -errno : -EIO;
 
@@ -471,6 +472,7 @@ static int write_temporary_passwd(const char *passwd_path, FILE **tmpfile, char
                 if (putpwent(&n, passwd) != 0)
                         return errno ? -errno : -EIO;
         }
+        errno = 0;
 
         /* Append the remaining NIS entries if any */
         while (pw) {
@@ -478,6 +480,7 @@ static int write_temporary_passwd(const char *passwd_path, FILE **tmpfile, char
                 if (putpwent(pw, passwd) < 0)
                         return errno ? -errno : -EIO;
 
+                errno = 0;
                 pw = fgetpwent(original);
         }
         if (!IN_SET(errno, 0, ENOENT))
@@ -497,6 +500,7 @@ static int write_temporary_passwd(const char *passwd_path, FILE **tmpfile, char
 static int write_temporary_shadow(const char *shadow_path, FILE **tmpfile, char **tmpfile_path) {
         _cleanup_fclose_ FILE *original = NULL, *shadow = NULL;
         _cleanup_(unlink_and_freep) char *shadow_tmp = NULL;
+        struct spwd *sp = NULL;
         Iterator iterator;
         long lstchg;
         Item *i;
@@ -513,7 +517,6 @@ static int write_temporary_shadow(const char *shadow_path, FILE **tmpfile, char
 
         original = fopen(shadow_path, "re");
         if (original) {
-                struct spwd *sp;
 
                 r = sync_rights(original, shadow);
                 if (r < 0)
@@ -534,6 +537,11 @@ static int write_temporary_shadow(const char *shadow_path, FILE **tmpfile, char
                         }
 
                         errno = 0;
+
+                        /* Make sure we keep the NIS entries (if any) at the end. */
+                        if (IN_SET(sp->sp_namp[0], '+', '-'))
+                                break;
+
                         if (putspent(sp, shadow) < 0)
                                 return errno ? -errno : -EIO;
 
@@ -566,6 +574,19 @@ static int write_temporary_shadow(const char *shadow_path, FILE **tmpfile, char
                 if (putspent(&n, shadow) != 0)
                         return errno ? -errno : -EIO;
         }
+        errno = 0;
+
+        /* Append the remaining NIS entries if any */
+        while (sp) {
+                errno = 0;
+                if (putspent(sp, shadow) < 0)
+                        return errno ? -errno : -EIO;
+
+                errno = 0;
+                sp = fgetspent(original);
+        }
+        if (!IN_SET(errno, 0, ENOENT))
+                return -errno;
 
         r = fflush_sync_and_check(shadow);
         if (r < 0)
@@ -619,6 +640,8 @@ static int write_temporary_group(const char *group_path, FILE **tmpfile, char **
                                 return  -EEXIST;
                         }
 
+                        errno = 0;
+
                         /* Make sure we keep the NIS entries (if any) at the end. */
                         if (IN_SET(gr->gr_name[0], '+', '-'))
                                 break;
@@ -654,6 +677,7 @@ static int write_temporary_group(const char *group_path, FILE **tmpfile, char **
 
                 group_changed = true;
         }
+        errno = 0;
 
         /* Append the remaining NIS entries if any */
         while (gr) {
@@ -661,6 +685,7 @@ static int write_temporary_group(const char *group_path, FILE **tmpfile, char **
                 if (putgrent(gr, group) != 0)
                         return errno > 0 ? -errno : -EIO;
 
+                errno = 0;
                 gr = fgetgrent(original);
         }
         if (!IN_SET(errno, 0, ENOENT))