diff --git a/modules/nixos/base/user-group.nix b/modules/nixos/base/user-group.nix
index 23cc2efa..32853fa4 100644
--- a/modules/nixos/base/user-group.nix
+++ b/modules/nixos/base/user-group.nix
@@ -34,8 +34,6 @@
       "users"
       "wheel"
       "networkmanager" # for nmtui / nm-connection-editor
-      "podman"
-      "docker"
       "wireshark"
       "adbusers" # android debugging
       "libvirtd" # virt-viewer / qemu
diff --git a/outputs/x86_64-linux/tests/security-container-groups/expected.nix b/outputs/x86_64-linux/tests/security-container-groups/expected.nix
new file mode 100644
index 00000000..9b900579
--- /dev/null
+++ b/outputs/x86_64-linux/tests/security-container-groups/expected.nix
@@ -0,0 +1,4 @@
+{
+  userHasDockerAccess = false;
+  userHasPodmanAccess = false;
+}
diff --git a/outputs/x86_64-linux/tests/security-container-groups/expr.nix b/outputs/x86_64-linux/tests/security-container-groups/expr.nix
new file mode 100644
index 00000000..25738d8c
--- /dev/null
+++ b/outputs/x86_64-linux/tests/security-container-groups/expr.nix
@@ -0,0 +1,8 @@
+{ outputs, ... }:
+let
+  userGroups = outputs.nixosConfigurations.ai-niri.config.users.users.ryan.extraGroups;
+in
+{
+  userHasDockerAccess = builtins.elem "docker" userGroups;
+  userHasPodmanAccess = builtins.elem "podman" userGroups;
+}