diff --git a/.github/local/needrestart b/.github/local/needrestart
index 33b23e014..3825baf61 100644
--- a/.github/local/needrestart
+++ b/.github/local/needrestart
@@ -1,2 +1,3 @@
 
+  @{bin}/waagent r,
   /var/lib/waagent/** r,
diff --git a/apparmor.d/groups/apt/deb-systemd-helper b/apparmor.d/groups/apt/deb-systemd-helper
index 28de2a8a0..a81ef6d7c 100644
--- a/apparmor.d/groups/apt/deb-systemd-helper
+++ b/apparmor.d/groups/apt/deb-systemd-helper
@@ -18,6 +18,7 @@ profile deb-systemd-helper @{exec_path} {
 
   /var/lib/systemd/deb-systemd-helper-enabled/** rw,
   /var/lib/systemd/deb-systemd-helper-masked/ rw,
+  /var/lib/systemd/deb-systemd-user-helper-enabled/** rw,
 
   profile systemctl {
     include <abstractions/base>
@@ -27,8 +28,11 @@ profile deb-systemd-helper @{exec_path} {
     /etc/systemd/ r,
     /etc/systemd/system/ r,
     /etc/systemd/system/* rw,
-    /etc/systemd/system/*.wants/ r,
+    /etc/systemd/system/*.wants/ rw,
     /etc/systemd/system/*.wants/* rw,
+    /etc/systemd/user/ r,
+    /etc/systemd/user/*.wants/ rw,
+    /etc/systemd/user/*.wants/* rw,
 
     include if exists <local/deb-systemd-helper_systemctl>
   }