diff --git a/Makefile.am b/Makefile.am
index b09b0cf1671..1ea25bb688c 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -1639,6 +1639,8 @@ EXTRA_DIST += \
 	test/test-execute/exec-privatedevices-yes.service \
 	test/test-execute/exec-privatedevices-no-capability-mknod.service \
 	test/test-execute/exec-privatedevices-yes-capability-mknod.service \
+	test/test-execute/exec-protectkernelmodules-no-capabilities.service \
+	test/test-execute/exec-protectkernelmodules-yes-capabilities.service \
 	test/test-execute/exec-privatetmp-no.service \
 	test/test-execute/exec-privatetmp-yes.service \
 	test/test-execute/exec-readonlypaths.service \
diff --git a/src/test/test-execute.c b/src/test/test-execute.c
index 8b4ff22495b..f7d38fb0f33 100644
--- a/src/test/test-execute.c
+++ b/src/test/test-execute.c
@@ -142,6 +142,16 @@ static void test_exec_privatedevices_capabilities(Manager *m) {
         test(m, "exec-privatedevices-no-capability-mknod.service", 0, CLD_EXITED);
 }
 
+static void test_exec_protectkernelmodules_capabilities(Manager *m) {
+        if (detect_container() > 0) {
+                log_notice("testing in container, skipping protectkernelmodules tests");
+                return;
+        }
+
+        test(m, "exec-protectkernelmodules-no-capabilities.service", 0, CLD_EXITED);
+        test(m, "exec-protectkernelmodules-yes-capabilities.service", 0, CLD_EXITED);
+}
+
 static void test_exec_readonlypaths(Manager *m) {
         test(m, "exec-readonlypaths.service", 0, CLD_EXITED);
         test(m, "exec-readonlypaths-mount-propagation.service", 0, CLD_EXITED);
@@ -368,6 +378,7 @@ int main(int argc, char *argv[]) {
                 test_exec_privatetmp,
                 test_exec_privatedevices,
                 test_exec_privatedevices_capabilities,
+                test_exec_protectkernelmodules_capabilities,
                 test_exec_readonlypaths,
                 test_exec_readwritepaths,
                 test_exec_inaccessiblepaths,
diff --git a/test/test-execute/exec-protectkernelmodules-no-capabilities.service b/test/test-execute/exec-protectkernelmodules-no-capabilities.service
new file mode 100644
index 00000000000..b2f2cd6b8ab
--- /dev/null
+++ b/test/test-execute/exec-protectkernelmodules-no-capabilities.service
@@ -0,0 +1,7 @@
+[Unit]
+Description=Test CAP_SYS_MODULE ProtectKernelModules=no
+
+[Service]
+ProtectKernelModules=no
+ExecStart=/bin/sh -x -c 'capsh --print | grep cap_sys_module'
+Type=oneshot
diff --git a/test/test-execute/exec-protectkernelmodules-yes-capabilities.service b/test/test-execute/exec-protectkernelmodules-yes-capabilities.service
new file mode 100644
index 00000000000..84bf39be569
--- /dev/null
+++ b/test/test-execute/exec-protectkernelmodules-yes-capabilities.service
@@ -0,0 +1,7 @@
+[Unit]
+Description=Test CAP_SYS_MODULE for ProtectKernelModules=yes
+
+[Service]
+ProtectKernelModules=yes
+ExecStart=/bin/sh -x -c '! capsh --print | grep cap_sys_module'
+Type=oneshot