diff --git a/bin/omarchy-system-factory-reset b/bin/omarchy-system-factory-reset
index f9e57d95..43348e5a 100755
--- a/bin/omarchy-system-factory-reset
+++ b/bin/omarchy-system-factory-reset
@@ -310,7 +310,7 @@ scrub_factory_accounts() {
   # passwd --lock preserves the hash. Replace it, then remove the backups
   # that userdel and usermod leave behind.
   usermod --root "$root" --password '!' root >>"$LOG_FILE" 2>&1 || return 1
-  rm -f "$root/etc/"{shadow-,gshadow-,passwd-,group-}
+  rm -f "$root/etc/"{shadow-,gshadow-,passwd-,group-,subuid-,subgid-}
 }
 
 # Remove the seller's account material and machine identity from the retained
diff --git a/test/shell.d/factory-reset-accounts-test.sh b/test/shell.d/factory-reset-accounts-test.sh
index 7f6f4a31..ed2bb697 100644
--- a/test/shell.d/factory-reset-accounts-test.sh
+++ b/test/shell.d/factory-reset-accounts-test.sh
@@ -90,8 +90,10 @@ EOF
   printf 'root:x:0:\ndaemon:x:1:\nseller:x:1000:\nwheel:x:998:seller\n' >"$factory/etc/group"
   printf 'root:!::\ndaemon:!::\nseller:!::\nwheel:!::seller\n' >"$factory/etc/gshadow"
   printf 'USERGROUPS_ENAB yes\n' >"$factory/etc/login.defs"
+  printf 'seller:100000:65536\n' >"$factory/etc/subuid"
+  printf 'seller:100000:65536\n' >"$factory/etc/subgid"
   chmod 600 "$factory/etc/"{shadow,gshadow}
-  for file in passwd shadow group gshadow; do
+  for file in passwd shadow group gshadow subuid subgid; do
     cp "$factory/etc/$file" "$factory/etc/$file-"
   done
 }
@@ -105,7 +107,7 @@ assert_scrubbed() {
   [[ ! -e $root/home/seller ]] || fail "reset removes the seller's baseline home"
   grep -q '^daemon:\*:' "$root/etc/shadow" || fail "reset preserves service accounts"
   [[ $(stat -c '%a' "$root/etc/shadow") == "600" ]] || fail "shadow stays private"
-  for file in passwd shadow group gshadow; do
+  for file in passwd shadow group gshadow subuid subgid; do
     [[ ! -e $root/etc/$file- ]] || fail "reset removes the $file backup"
   done
 }