diff --git a/apparmor.d/groups/systemd/systemd-userdbd b/apparmor.d/groups/systemd/systemd-userdbd
new file mode 100644
index 00000000..59e3dc23
--- /dev/null
+++ b/apparmor.d/groups/systemd/systemd-userdbd
@@ -0,0 +1,34 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}lib/systemd/systemd-userdbd
+profile systemd-userdbd @{exec_path} flags=(attach_disconnected) {
+  include <abstractions/base>
+  include <abstractions/nameservice-strict>
+  include <abstractions/systemd-common>
+
+  capability dac_read_search,
+  capability sys_resource,
+
+  network inet dgram,
+  network inet6 dgram,
+  network inet raw,
+  network inet6 raw,
+  network netlink raw,
+
+  @{exec_path} mr,
+
+  /{usr/,}lib/systemd/systemd-userwork rPx,
+
+  /etc/shadow r,
+  /etc/machine-id r,
+
+  @{run}/systemd/userdb/{,**} rw,
+
+  include if exists <local/systemd-userdbd>
+}
\ No newline at end of file
diff --git a/apparmor.d/groups/systemd/systemd-userwork b/apparmor.d/groups/systemd/systemd-userwork
new file mode 100644
index 00000000..920a2eaa
--- /dev/null
+++ b/apparmor.d/groups/systemd/systemd-userwork
@@ -0,0 +1,22 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}lib/systemd/systemd-userwork
+profile systemd-userwork @{exec_path} flags=(attach_disconnected) {
+  include <abstractions/base>
+  include <abstractions/nameservice-strict>
+  include <abstractions/systemd-common>
+
+  @{exec_path} mr,
+
+  /etc/machine-id r,
+
+  @{run}/systemd/userdb/ r,
+
+  include if exists <local/systemd-userwork>
+}
\ No newline at end of file
diff --git a/dists/flags/main.flags b/dists/flags/main.flags
index 7ebf15ca..faeb2a48 100644
--- a/dists/flags/main.flags
+++ b/dists/flags/main.flags
@@ -240,6 +240,8 @@ systemd-update-done complain
 systemd-update-utmp complain
 systemd-user-runtime-dir complain
 systemd-user-sessions complain
+systemd-userdbd attach_disconnected,complain
+systemd-userwork complain
 systemd-vconsole-setup complain
 systemd-xdg-autostart-generator complain
 tracker-extract complain