diff --git a/install/config/printing.sh b/install/config/printing.sh
index b99e03c3..31c969ea 100644
--- a/install/config/printing.sh
+++ b/install/config/printing.sh
@@ -16,7 +16,7 @@ elif [[ -f $cups_files_conf ]]; then
 
   if ! awk '
     NR == FNR {
-      if ($1 == "SystemGroup") {
+      if (tolower($1) == "systemgroup") {
         for (i = 2; i <= NF; i++) {
           if (substr($i, 1, 1) == "#")
             break
@@ -29,7 +29,7 @@ elif [[ -f $cups_files_conf ]]; then
       next
     }
 
-    $1 == "SystemGroup" {
+    tolower($1) == "systemgroup" {
       comment_start = index($0, "#")
       if (!wrote_system_group) {
         printf "SystemGroup"
@@ -47,7 +47,7 @@ elif [[ -f $cups_files_conf ]]; then
       next
     }
 
-    $1 == "PeerCred" {
+    tolower($1) == "peercred" {
       comment_start = index($0, "#")
       if (!saw_peer_cred) {
         printf "PeerCred on"
diff --git a/test/shell.d/cups-hardening-test.sh b/test/shell.d/cups-hardening-test.sh
index f5c92e44..2f0bc96a 100644
--- a/test/shell.d/cups-hardening-test.sh
+++ b/test/shell.d/cups-hardening-test.sh
@@ -222,3 +222,31 @@ OMARCHY_CUPS_TEST_LOG="$masked_log" \
 [[ -f $masked_marker ]] || fail "the migration completes with cups-browsed masked"
 
 pass "a masked or disabled cups-browsed is left alone and does not fail the migration"
+
+# cupsd compares directive names case-insensitively, so a hand-edited lowercase
+# directive is live configuration. Matching it exactly would skip the line and
+# append a second one, and cupsd accumulates the groups of every SystemGroup
+# directive it reads -- leaving wheel with passwordless administration.
+lowercase_conf="$test_tmp/etc/cups/lowercase.conf"
+cat >"$lowercase_conf" <<'CONF'
+systemgroup sys root wheel
+peercred off
+CONF
+
+PATH="$mock_bin:$PATH" \
+  OMARCHY_CUPS_FILES_CONF="$lowercase_conf" \
+  OMARCHY_CUPS_BROWSED_SYSUSERS_CONF="$sysusers_conf" \
+  bash -euo pipefail "$ROOT/install/config/printing.sh"
+
+! grep -qiE '^[[:space:]]*systemgroup\b.*\bwheel\b' "$lowercase_conf" ||
+  fail "printing setup removes wheel from a lowercase SystemGroup directive" "$(cat "$lowercase_conf")"
+[[ $(grep -ciE '^[[:space:]]*systemgroup\b' "$lowercase_conf") == 1 ]] ||
+  fail "printing setup leaves one SystemGroup directive whatever case it was written in" "$(cat "$lowercase_conf")"
+grep -qxF 'SystemGroup sys root cups-browsed' "$lowercase_conf" ||
+  fail "printing setup reserves administration for the service account" "$(cat "$lowercase_conf")"
+[[ $(grep -ciE '^[[:space:]]*peercred\b' "$lowercase_conf") == 1 ]] ||
+  fail "printing setup leaves one PeerCred directive" "$(cat "$lowercase_conf")"
+grep -qxF 'PeerCred on' "$lowercase_conf" ||
+  fail "printing setup enables peer credentials whatever case they were written in" "$(cat "$lowercase_conf")"
+
+pass "printing setup rewrites directives cupsd reads case-insensitively"