diff --git a/modules/services/forgejo.nix b/modules/services/forgejo.nix
index 0253de9..10fd26b 100644
--- a/modules/services/forgejo.nix
+++ b/modules/services/forgejo.nix
@@ -493,7 +493,7 @@ in
               --bind-password       $(tr -d '\n' < ${cfg.ldap.adminPassword.result.path}) \
               --security-protocol   Unencrypted \
               --user-search-base    ou=people,${cfg.ldap.dcdomain} \
-              --user-filter         '(&(memberof=cn=${cfg.ldap.userGroup},ou=groups,${cfg.ldap.dcdomain})(|(uid=%[1]s)(mail=%[1]s)))' \
+              --user-filter         '(&(|(memberof=cn=${cfg.ldap.userGroup},ou=groups,${cfg.ldap.dcdomain})(memberof=cn=${cfg.ldap.adminGroup},ou=groups,${cfg.ldap.dcdomain}))(|(uid=%[1]s)(mail=%[1]s)))' \
               --admin-filter        '(memberof=cn=${cfg.ldap.adminGroup},ou=groups,${cfg.ldap.dcdomain})' \
               --username-attribute  uid \
               --firstname-attribute givenName \
@@ -512,7 +512,7 @@ in
               --bind-password       $(tr -d '\n' < ${cfg.ldap.adminPassword.result.path}) \
               --security-protocol   Unencrypted \
               --user-search-base    ou=people,${cfg.ldap.dcdomain} \
-              --user-filter         '(&(memberof=cn=${cfg.ldap.userGroup},ou=groups,${cfg.ldap.dcdomain})(|(uid=%[1]s)(mail=%[1]s)))' \
+              --user-filter         '(&(|(memberof=cn=${cfg.ldap.userGroup},ou=groups,${cfg.ldap.dcdomain})(memberof=cn=${cfg.ldap.adminGroup},ou=groups,${cfg.ldap.dcdomain}))(|(uid=%[1]s)(mail=%[1]s)))' \
               --admin-filter        '(memberof=cn=${cfg.ldap.adminGroup},ou=groups,${cfg.ldap.dcdomain})' \
               --username-attribute  uid \
               --firstname-attribute givenName \
diff --git a/test/services/forgejo.nix b/test/services/forgejo.nix
index bf68b17..ac9c843 100644
--- a/test/services/forgejo.nix
+++ b/test/services/forgejo.nix
@@ -149,6 +149,7 @@ let
           waitForSystemdServices = [ "lldap.service" ];
 
           userGroup = "user_group";
+          adminGroup = "admin_group";
         };
       };