diff --git a/10-setup-htcondor.sh b/10-setup-htcondor.sh
index 55919b4..24c4f1f 100755
--- a/10-setup-htcondor.sh
+++ b/10-setup-htcondor.sh
@@ -627,6 +627,17 @@ do
 done <$condor_vars_file
 set -x
 
+# osg-flock's additional-htcondor-config only adds directories from
+# GLIDEIN_SINGULARITY_BINDPATH to SINGULARITY_BIND_EXPR.  Its file check drops
+# /etc/passwd, which the native HTCondor container path also needs when
+# cvmfsexec created a nested user namespace.  The GlideinWMS wrapper reads
+# GLIDEIN_SINGULARITY_BINDPATH directly and already receives this bind.
+if [[ $CVMFSEXEC_PASSWD_BIND == 1 ]]; then
+    singularity_bind_expr=${SINGULARITY_BIND_EXPR#\"}
+    singularity_bind_expr=${singularity_bind_expr%\"}
+    echo "SINGULARITY_BIND_EXPR = \"${singularity_bind_expr},/etc/passwd\"" >> "$PILOT_CONFIG_FILE"
+fi
+
 if [[ $EXTRA_JOB_ENV ]]; then
     job_env="$job_env $EXTRA_JOB_ENV"
 fi
diff --git a/sbin/entrypoint.sh b/sbin/entrypoint.sh
index 97b84dd..2595a85 100755
--- a/sbin/entrypoint.sh
+++ b/sbin/entrypoint.sh
@@ -89,6 +89,7 @@ CVMFSEXEC_REPOS=$(tr -d '"'"'" <<<$CVMFSEXEC_REPOS)  # delete single and double
 # lookup. This replaces the job image's own /etc/passwd, so it only runs
 # when cvmfsexec is actually creating that nested namespace.
 export SINGULARITY_BIND_EXTRA="${SINGULARITY_BIND_EXTRA:+$SINGULARITY_BIND_EXTRA,}/etc/passwd"
+export CVMFSEXEC_PASSWD_BIND=1
 
 cd "$cvmfsexec_root" || \
     fail "Couldn't enter $cvmfsexec_root"
diff --git a/tests/test_inside_gha.sh b/tests/test_inside_gha.sh
index b5c283c..403e823 100755
--- a/tests/test_inside_gha.sh
+++ b/tests/test_inside_gha.sh
@@ -2,7 +2,7 @@
 # shellcheck disable=SC2086
 
 APPTAINER_BIN=/usr/bin/apptainer
-OSP_TOKEN_PATH=/tmp/token
+OSP_TOKEN_PATH=${OSP_TOKEN_PATH:-/tmp/token}
 CONDOR_LOGDIR=/pilot/log
 COMMON_APPTAINER_EXEC_ARGS="-B /cvmfs -B /dev/fuse -c -i"
 COMMON_DOCKER_RUN_ARGS="--user osg
@@ -102,7 +102,8 @@ function docker_exit_with_cleanup {
 
 function print_test_header {
     msg=$*
-    sep=$(python -c "print ('=' * ${#msg})")
+    printf -v sep '%*s' "${msg}" ''
+    sep=${sep// /=}
     echo -e "$sep\n$msg\n$sep"
 }
 
@@ -192,6 +193,24 @@ function test_docker_HAS_SINGULARITY {
     return 1
 }
 
+function test_docker_passwd_bind {
+    [[ $CVMFS_INSTALL == cvmfsexec ]] || return 0
+    print_test_header "Testing HTCondor passwd bind under cvmfsexec"
+
+    local binds
+    binds=$(run_inside_backfill_container /bin/bash -c '
+        PILOT_CONFIG_FILE=$(find /pilot -maxdepth 2 -name condor_config.pilot -print -quit)
+        export PILOT_CONFIG_FILE
+        condor_config_val SINGULARITY_BIND_EXPR
+    ') || return $?
+    binds=${binds#\"}
+    binds=${binds%\"}
+    if [[ ,$binds, != *,/etc/passwd,* ]]; then
+        echo "HTCondor SINGULARITY_BIND_EXPR omits /etc/passwd: $binds" >&2
+        return 1
+    fi
+}
+
 function test_singularity_startup {
     print_test_header "Testing container startup"
 
@@ -402,6 +421,7 @@ elif [[ $TESTTYPE == pilot ]]; then
             start_docker_backfill "${DOCKER_EXTRA_ARGS[@]}" || docker_exit_with_cleanup $?
             test_docker_startup                             || docker_exit_with_cleanup $?
             test_docker_HAS_SINGULARITY                     || docker_exit_with_cleanup $?
+            test_docker_passwd_bind                          || docker_exit_with_cleanup $?
             docker stop backfill
             docker_exit_with_cleanup 0
             ;;