diff --git a/src/core/main.c b/src/core/main.c
index 9934bda1f3..e2cdf7d532 100644
--- a/src/core/main.c
+++ b/src/core/main.c
@@ -1793,13 +1793,17 @@ static int do_reexecute(
                 xsprintf(sfd, "--deserialize=%i", fileno(arg_serialization));
 
                 i = 1;         /* Leave args[0] empty for now. */
-                filter_args(args, &i, argv, argc);
 
+                /* Put our stuff first to make sure it always gets parsed in case
+                 * we get weird stuff from the kernel cmdline (like --) */
                 if (switch_root_dir)
                         args[i++] = "--switched-root";
 
                 args[i++] = arg_system ? "--system" : "--user";
                 args[i++] = sfd;
+
+                filter_args(args, &i, argv, argc);
+
                 args[i++] = NULL;
 
                 assert(i <= args_size);
diff --git a/test/TEST-01-BASIC/test.sh b/test/TEST-01-BASIC/test.sh
index a790cd78ac..62529c7973 100755
--- a/test/TEST-01-BASIC/test.sh
+++ b/test/TEST-01-BASIC/test.sh
@@ -7,6 +7,11 @@ IMAGE_NAME="basic"
 RUN_IN_UNPRIVILEGED_CONTAINER=${RUN_IN_UNPRIVILEGED_CONTAINER:-yes}
 TEST_REQUIRE_INSTALL_TESTS=0
 
+# Check if we can correctly deserialize if the kernel cmdline contains "weird" stuff
+# like an invalid argument, "end of arguments" separator, or a sysvinit argument (-z)
+# See: https://github.com/systemd/systemd/issues/28184
+KERNEL_APPEND="foo -- -z bar --- baz $KERNEL_APPEND"
+
 # shellcheck source=test/test-functions
 . "${TEST_BASE_DIR:?}/test-functions"