diff --git a/catalog/BUCK b/catalog/BUCK
index 5a03b7ec..967bdc82 100644
--- a/catalog/BUCK
+++ b/catalog/BUCK
@@ -51,6 +51,9 @@ box.new(
         "ca-certificates",
         # the uki driver resolves module dependencies through libkmod
         "kmod-libs",
+        # The relaxed sandbox binds the host's nsswitch.conf. Without libnss_systemd, getpwuid() cannot find
+        # a systemd-homed caller, and ssh-keygen aborts.
+        "systemd-libs",
         "systemd-udev",
         "systemd-ukify",
         # ukify needs these to sign UKIs and parse PEs, but they are only weak dependencies
@@ -117,6 +120,9 @@ box.new(
         "kmod",
         # udev, repart, tmpfiles, sysusers and bootctl all ship here
         "systemd",
+        # The relaxed sandbox binds the host's nsswitch.conf. Without libnss_systemd, getpwuid() cannot find
+        # a systemd-homed caller, and ssh-keygen aborts.
+        "systemd-libs",
         "systemd-ukify",
         # ukify needs these to sign UKIs and parse PEs, but they are only optional dependencies
         "python-cryptography",
@@ -160,6 +166,9 @@ box.new(
         "kmod",
         # image/kmod.py loads libkmod.so.2 with dlopen(), and no package in this list depends on it.
         "libkmod2",
+        # The relaxed sandbox binds the host's nsswitch.conf. Without libnss_systemd, getpwuid() cannot find
+        # a systemd-homed caller, and ssh-keygen aborts.
+        "libnss-systemd",
         "libseccomp2",
         "mtools",
         "python3",
diff --git a/catalog/snapshot/box/debian.testing.arm64.json b/catalog/snapshot/box/debian.testing.arm64.json
index 2ecb3906..3ef36d8c 100644
--- a/catalog/snapshot/box/debian.testing.arm64.json
+++ b/catalog/snapshot/box/debian.testing.arm64.json
@@ -559,6 +559,14 @@
     "size": 24720,
     "url": "https://snapshot.debian.org/archive/debian/20261003T204240Z/pool/main/n/ngtcp2/libngtcp2-crypto-ossl0_1.24.0-1_arm64.deb"
   },
+  {
+    "package_id": "libnss-systemd_262-1_arm64",
+    "repo": "debian.testing.main.repository",
+    "pkg_checksum": "082f1b835d187eff284ec04f4905d8566a00f55d6016daa567056d34e44882e6",
+    "source": "repo",
+    "size": 209272,
+    "url": "https://snapshot.debian.org/archive/debian/20261003T204240Z/pool/main/s/systemd/libnss-systemd_262-1_arm64.deb"
+  },
   {
     "package_id": "libpam-modules-bin_1.7.0-8_arm64",
     "repo": "debian.testing.main.repository",
diff --git a/catalog/snapshot/box/debian.testing.x86_64.json b/catalog/snapshot/box/debian.testing.x86_64.json
index 6063b8f9..f3902b07 100644
--- a/catalog/snapshot/box/debian.testing.x86_64.json
+++ b/catalog/snapshot/box/debian.testing.x86_64.json
@@ -559,6 +559,14 @@
     "size": 26468,
     "url": "https://snapshot.debian.org/archive/debian/20261003T204240Z/pool/main/n/ngtcp2/libngtcp2-crypto-ossl0_1.24.0-1_amd64.deb"
   },
+  {
+    "package_id": "libnss-systemd_262-1_amd64",
+    "repo": "debian.testing.main.repository",
+    "pkg_checksum": "5903088dee5c8ded1be149f058f570e4e869b29a70d14ba789cc3d324ecb2b1d",
+    "source": "repo",
+    "size": 245568,
+    "url": "https://snapshot.debian.org/archive/debian/20261003T204240Z/pool/main/s/systemd/libnss-systemd_262-1_amd64.deb"
+  },
   {
     "package_id": "libpam-modules-bin_1.7.0-8_amd64",
     "repo": "debian.testing.main.repository",