diff --git a/nixos/tests/acl.nix b/nixos/tests/acl.nix
new file mode 100644
index 000000000000..189abc08f420
--- /dev/null
+++ b/nixos/tests/acl.nix
@@ -0,0 +1,33 @@
+{
+  vmTools,
+  perl,
+  coreutils,
+  acl,
+}:
+# Can't run this within a VM because tests require root access
+# Can't easily use a standard VM test because we need to have access to intermediate build results
+vmTools.runInLinuxVM (
+  acl.overrideAttrs (old: {
+    postPatch = old.postPatch or "" + ''
+      # The runwrapper uses LD_PRELOAD to override available user/groups
+      substituteInPlace Makefile.in --replace-fail \
+        'TEST_LOG_COMPILER = $(srcdir)/test/runwrapper' \
+        'TEST_LOG_COMPILER = $(srcdir)/test/run'
+    '';
+    nativeCheckInputs = old.nativeCheckInputs or [ ] ++ [
+      perl
+      # By default `ls` would come from bootstrap tools,
+      # which doesn't support showing ACLs, which the tests rely on
+      coreutils
+    ];
+    preCheck = ''
+      cp test/test.passwd /etc/passwd
+      cp test/test.group /etc/group
+    '';
+    doCheck = true;
+    outputs = [ "out" ];
+    installPhase = ''
+      touch $out
+    '';
+  })
+)
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index ac16eaf315a7..bd0bbbaff891 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -188,6 +188,7 @@ in
   # keep-sorted start case=no numeric=no block=yes
   _3proxy = runTest ./3proxy.nix;
   aaaaxy = runTest ./aaaaxy.nix;
+  acl = pkgs.callPackage ./acl.nix { };
   acme = import ./acme/default.nix {
     inherit runTest;
     inherit (pkgs) lib;