diff --git a/src/basic/conf-files.c b/src/basic/conf-files.c
index d776583c05..907d1350fe 100644
--- a/src/basic/conf-files.c
+++ b/src/basic/conf-files.c
@@ -74,16 +74,21 @@ static int files_add(Hashmap *h, const char *suffix, const char *root, unsigned
                                 continue;
                         }
 
-                        /* We only want executable regular files (or symlinks to them), or symlinks to /dev/null */
-                        if (S_ISREG(st.st_mode)) {
-                                if ((st.st_mode & 0111) == 0) { /* not executable */
-                                        log_debug("Ignoring %s/%s, as it is not marked executable.", dirpath, de->d_name);
+                        if (!null_or_empty(&st)) {
+                                /* A mask is a symlink to /dev/null or an empty file. It does not even
+                                 * have to be executable. Other entries must be regular executable files
+                                 * or symlinks to them. */
+                                if (S_ISREG(st.st_mode)) {
+                                        if ((st.st_mode & 0111) == 0) { /* not executable */
+                                                log_debug("Ignoring %s/%s, as it is not marked executable.",
+                                                          dirpath, de->d_name);
+                                                continue;
+                                        }
+                                } else {
+                                        log_debug("Ignoring %s/%s, as it is neither a regular file nor a mask.",
+                                                  dirpath, de->d_name);
                                         continue;
                                 }
-
-                        } else if (!null_or_empty(&st)) { /* /dev/null? */
-                                log_debug("Ignoring %s/%s, as it is not a regular file (or symlink to /dev/null).", dirpath, de->d_name);
-                                continue;
                         }
                 }
 
diff --git a/src/test/test-exec-util.c b/src/test/test-exec-util.c
index 30c92019d9..c192d3522c 100644
--- a/src/test/test-exec-util.c
+++ b/src/test/test-exec-util.c
@@ -71,10 +71,14 @@ static const gather_stdout_callback_t ignore_stdout[] = {
 };
 
 static void test_execute_directory(bool gather_stdout) {
-        char template_lo[] = "/tmp/test-exec-util.XXXXXXX";
-        char template_hi[] = "/tmp/test-exec-util.XXXXXXX";
+        char template_lo[] = "/tmp/test-exec-util.lo.XXXXXXX";
+        char template_hi[] = "/tmp/test-exec-util.hi.XXXXXXX";
         const char * dirs[] = {template_hi, template_lo, NULL};
-        const char *name, *name2, *name3, *overridden, *override, *masked, *mask;
+        const char *name, *name2, *name3,
+                *overridden, *override,
+                *masked, *mask,
+                *masked2, *mask2,   /* the mask is non-executable */
+                *masked2e, *mask2e; /* the mask is executable */
 
         log_info("/* %s (%s) */", __func__, gather_stdout ? "gathering stdout" : "asynchronous");
 
@@ -88,6 +92,10 @@ static void test_execute_directory(bool gather_stdout) {
         override = strjoina(template_hi, "/overridden");
         masked = strjoina(template_lo, "/masked");
         mask = strjoina(template_hi, "/masked");
+        masked2 = strjoina(template_lo, "/masked2");
+        mask2 = strjoina(template_hi, "/masked2");
+        masked2e = strjoina(template_lo, "/masked2e");
+        mask2e = strjoina(template_hi, "/masked2e");
 
         assert_se(write_string_file(name,
                                     "#!/bin/sh\necho 'Executing '$0\ntouch $(dirname $0)/it_works",
@@ -104,7 +112,15 @@ static void test_execute_directory(bool gather_stdout) {
         assert_se(write_string_file(masked,
                                     "#!/bin/sh\necho 'Executing '$0\ntouch $(dirname $0)/failed",
                                     WRITE_STRING_FILE_CREATE) == 0);
+        assert_se(write_string_file(masked2,
+                                    "#!/bin/sh\necho 'Executing '$0\ntouch $(dirname $0)/failed",
+                                    WRITE_STRING_FILE_CREATE) == 0);
+        assert_se(write_string_file(masked2e,
+                                    "#!/bin/sh\necho 'Executing '$0\ntouch $(dirname $0)/failed",
+                                    WRITE_STRING_FILE_CREATE) == 0);
         assert_se(symlink("/dev/null", mask) == 0);
+        assert_se(touch(mask2) == 0);
+        assert_se(touch(mask2e) == 0);
         assert_se(touch(name3) >= 0);
 
         assert_se(chmod(name, 0755) == 0);
@@ -112,6 +128,9 @@ static void test_execute_directory(bool gather_stdout) {
         assert_se(chmod(overridden, 0755) == 0);
         assert_se(chmod(override, 0755) == 0);
         assert_se(chmod(masked, 0755) == 0);
+        assert_se(chmod(masked2, 0755) == 0);
+        assert_se(chmod(masked2e, 0755) == 0);
+        assert_se(chmod(mask2e, 0755) == 0);
 
         if (gather_stdout)
                 execute_directories(dirs, DEFAULT_TIMEOUT_USEC, ignore_stdout, ignore_stdout_args, NULL);