diff --git a/man/systemd.service.xml b/man/systemd.service.xml
index af14eedfcc..f57e37ca5b 100644
--- a/man/systemd.service.xml
+++ b/man/systemd.service.xml
@@ -1328,9 +1328,10 @@ WantedBy=multi-user.target</programlisting>
 
       <para><varname>Type=</varname><option>oneshot</option> are the
       only service units that may have more than one
-      <varname>ExecStart=</varname> specified. They will be executed
-      in order until either they are all successful or one of them
-      fails.</para>
+      <varname>ExecStart=</varname> specified. For units with multiple
+      commands (<varname noindex="true">Type=oneshot</varname>), all commands will be run again.</para>
+      <para> For <varname noindex="true">Type=oneshot</varname>, <varname>Restart=</varname><option>always</option>
+      and <varname>Restart=</varname><option>on-success</option> are <emphasis>not</emphasis> allowed.</para>
     </example>
 
     <example>
diff --git a/src/core/service.c b/src/core/service.c
index ada25e634a..45b5f4b6a0 100644
--- a/src/core/service.c
+++ b/src/core/service.c
@@ -577,8 +577,9 @@ static int service_verify(Service *s) {
                 return -ENOEXEC;
         }
 
-        if (s->type == SERVICE_ONESHOT && s->restart != SERVICE_RESTART_NO) {
-                log_unit_error(UNIT(s), "Service has Restart= setting other than no, which isn't allowed for Type=oneshot services. Refusing.");
+        if (s->type == SERVICE_ONESHOT
+            && !IN_SET(s->restart, SERVICE_RESTART_NO, SERVICE_RESTART_ON_FAILURE, SERVICE_RESTART_ON_ABNORMAL, SERVICE_RESTART_ON_WATCHDOG, SERVICE_RESTART_ON_ABORT)) {
+                log_unit_error(UNIT(s), "Service has Restart= set to either always or on-success, which isn't allowed for Type=oneshot services. Refusing.");
                 return -ENOEXEC;
         }
 
diff --git a/test/TEST-41-ONESHOT-RESTART/Makefile b/test/TEST-41-ONESHOT-RESTART/Makefile
new file mode 100644
index 0000000000..45e9bfc67c
--- /dev/null
+++ b/test/TEST-41-ONESHOT-RESTART/Makefile
@@ -0,0 +1,9 @@
+BUILD_DIR=$(shell ../../tools/find-build-dir.sh)
+
+all setup run:
+	@basedir=../.. TEST_BASE_DIR=../ BUILD_DIR=$(BUILD_DIR) ./test.sh --$@
+
+clean clean-again:
+	@basedir=../.. TEST_BASE_DIR=../ BUILD_DIR=$(BUILD_DIR) ./test.sh --clean
+
+.PHONY: all setup run clean clean-again
diff --git a/test/TEST-41-ONESHOT-RESTART/test.sh b/test/TEST-41-ONESHOT-RESTART/test.sh
new file mode 100755
index 0000000000..96c21da642
--- /dev/null
+++ b/test/TEST-41-ONESHOT-RESTART/test.sh
@@ -0,0 +1,32 @@
+#!/bin/bash
+set -e
+TEST_DESCRIPTION="Test oneshot unit restart on failure"
+. $TEST_BASE_DIR/test-functions
+
+test_setup() {
+    create_empty_image_rootdir
+
+    (
+        LOG_LEVEL=5
+        eval $(udevadm info --export --query=env --name=${LOOPDEV}p2)
+
+        setup_basic_environment
+        mask_supporting_services
+
+        # setup the testsuite service
+        cat >$initdir/etc/systemd/system/testsuite.service <<EOF
+[Unit]
+Description=Testsuite service
+
+[Service]
+ExecStart=/testsuite.sh
+Type=oneshot
+EOF
+        cp testsuite.sh $initdir/
+
+        setup_testsuite
+    )
+    setup_nspawn_root
+}
+
+do_test "$@"
diff --git a/test/TEST-41-ONESHOT-RESTART/testsuite.sh b/test/TEST-41-ONESHOT-RESTART/testsuite.sh
new file mode 100755
index 0000000000..f7423dbf9a
--- /dev/null
+++ b/test/TEST-41-ONESHOT-RESTART/testsuite.sh
@@ -0,0 +1,33 @@
+#!/bin/bash
+set -ex
+set -o pipefail
+
+systemd-analyze log-level debug
+systemd-analyze log-target console
+
+# These three commands should succeed.
+! systemd-run --unit=one -p Type=oneshot -p Restart=on-failure /bin/bash -c "exit 1"
+
+sleep 5
+
+if [[ "$(systemctl show one.service -p NRestarts --value)" -le 0 ]]; then
+  exit 1
+fi
+
+TMP_FILE="/test-41-oneshot-restart-test"
+
+touch $TMP_FILE
+
+! systemd-run --unit=two -p StartLimitBurst=3 -p Type=oneshot -p Restart=on-failure -p ExecStart="/bin/bash -c \"printf a >>  $TMP_FILE\"" /bin/bash -c "exit 1"
+
+sleep 5
+
+if [[ $(cat $TMP_FILE) != "aaa" ]]; then
+  exit 1
+fi
+
+systemd-analyze log-level info
+
+echo OK > /testok
+
+exit 0