diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c
index 21b6f0695e6..5e31977cce9 100644
--- a/src/shared/seccomp-util.c
+++ b/src/shared/seccomp-util.c
@@ -1776,7 +1776,9 @@ int seccomp_restrict_address_families(Set *address_families, bool allow_list) {
                         void *af;
 
                         /* If this is a deny list, then generate one rule for each address family that are
-                         * then combined in OR checks. */
+                         * then combined in OR checks. The kernel takes the domain as an int, i.e. it
+                         * truncates the 64-bit register to its low 32 bits, hence only compare those. A plain
+                         * equality check could be bypassed by setting any of the upper bits. */
 
                         SET_FOREACH(af, address_families) {
                                 r = sym_seccomp_rule_add_exact(
@@ -1784,7 +1786,7 @@ int seccomp_restrict_address_families(Set *address_families, bool allow_list) {
                                                 SCMP_ACT_ERRNO(EAFNOSUPPORT),
                                                 SCMP_SYS(socket),
                                                 1,
-                                                SCMP_A0(SCMP_CMP_EQ, PTR_TO_INT(af)));
+                                                SCMP_A0(SCMP_CMP_MASKED_EQ, UINT32_MAX, (uint32_t) PTR_TO_INT(af)));
                                 if (r < 0)
                                         break;
                         }
diff --git a/src/test/test-seccomp.c b/src/test/test-seccomp.c
index 44682b4a2c0..2bae18f97fd 100644
--- a/src/test/test-seccomp.c
+++ b/src/test/test-seccomp.c
@@ -444,6 +444,13 @@ TEST(restrict_address_families) {
 #else
                 assert_se(fd < 0);
                 assert_se(errno == EAFNOSUPPORT);
+
+                /* The kernel truncates the domain to 32 bits, make sure setting upper bits doesn't bypass the filter */
+                if (sizeof(long) == 8) {
+                        fd = syscall(__NR_socket, UINT64_C(1) << 32 | AF_UNIX, SOCK_DGRAM, 0);
+                        assert_se(fd < 0);
+                        assert_se(errno == EAFNOSUPPORT);
+                }
 #endif
 
                 fd = socket(AF_NETLINK, SOCK_DGRAM, 0);
@@ -467,6 +474,13 @@ TEST(restrict_address_families) {
 #else
                 assert_se(fd < 0);
                 assert_se(errno == EAFNOSUPPORT);
+
+                /* Same as above, the allow list must not be bypassed by setting upper bits either */
+                if (sizeof(long) == 8) {
+                        fd = syscall(__NR_socket, UINT64_C(1) << 32 | AF_UNIX, SOCK_DGRAM, 0);
+                        assert_se(fd < 0);
+                        assert_se(errno == EAFNOSUPPORT);
+                }
 #endif
 
                 fd = socket(AF_NETLINK, SOCK_DGRAM, 0);