diff --git a/testing/hosts/default/usr/local/bin/systemctl b/testing/hosts/default/usr/local/bin/systemctl
index 0fc264fee..51e188c0e 100755
--- a/testing/hosts/default/usr/local/bin/systemctl
+++ b/testing/hosts/default/usr/local/bin/systemctl
@@ -8,7 +8,7 @@ ORIG=/bin/systemctl
 CONF=/lib/systemd/system/strongswan.service
 
 if [[ "$2" != "strongswan" ]]; then
-	$ORIG "$@"
+	exec $ORIG "$@"
 fi
 
 if [[ "$1" == "start" && -n $LEAK_DETECTIVE_LOG ]]; then
@@ -16,7 +16,10 @@ if [[ "$1" == "start" && -n $LEAK_DETECTIVE_LOG ]]; then
 fi
 
 $ORIG "$@"
+STATUS=$?
 
 if [[ "$1" == "stop" ]]; then
 	sed -i '/LEAK_DETECTIVE_LOG/d' $CONF 2>/dev/null
 fi
+
+exit $STATUS
diff --git a/testing/scripts/build-guestimages b/testing/scripts/build-guestimages
index 3619b5e94..cef1a8297 100755
--- a/testing/scripts/build-guestimages
+++ b/testing/scripts/build-guestimages
@@ -76,10 +76,19 @@ do
 		execute_chroot "dnssec-signzone -K /etc/bind -o org. /etc/bind/db.org" 0
 		execute_chroot "dnssec-signzone -K /etc/bind -o . /etc/bind/db.root" 0
 
-		# on bullseye, enabling via bind9 doesn't work, while disabling does, so
-		# use named there. on the other hand, older releases don't have named
-		# service files (systemctl returns 0 even if files are not found)
-		for service in apache2 slapd bind9 named
+		# on bullseye and newer, enabling via bind9 doesn't work, while
+		# disabling does, so use named here. on the other hand, older releases
+		# like buster don't have named service files
+		SERVICES="apache2 slapd"
+		case "$BASEIMGSUITE" in
+		buster)
+			SERVICES="$SERVICES bind9"
+			;;
+		*)
+			SERVICES="$SERVICES named"
+			;;
+		esac
+		for service in $SERVICES
 		do
 			execute_chroot "systemctl enable $service" 0
 		done