diff --git a/util/osuser/group_ids.go b/util/osuser/group_ids.go
index a08472598..f25861dbb 100644
--- a/util/osuser/group_ids.go
+++ b/util/osuser/group_ids.go
@@ -46,5 +46,9 @@ func getGroupIdsWithId(usernameOrUID string) ([]string, error) {
 	if err != nil {
 		return nil, fmt.Errorf("running 'id' command: %w", err)
 	}
-	return strings.Split(string(out), "\x00"), nil
+	return parseGroupIds(out), nil
+}
+
+func parseGroupIds(cmdOutput []byte) []string {
+	return strings.Split(strings.Trim(string(cmdOutput), "\n\x00"), "\x00")
 }
diff --git a/util/osuser/group_ids_test.go b/util/osuser/group_ids_test.go
new file mode 100644
index 000000000..69e8336ea
--- /dev/null
+++ b/util/osuser/group_ids_test.go
@@ -0,0 +1,26 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package osuser
+
+import (
+	"slices"
+	"testing"
+)
+
+func TestParseGroupIds(t *testing.T) {
+	tests := []struct {
+		in       string
+		expected []string
+	}{
+		{"5000\x005001\n", []string{"5000", "5001"}},
+		{"5000\n", []string{"5000"}},
+		{"\n", []string{""}},
+	}
+	for _, test := range tests {
+		actual := parseGroupIds([]byte(test.in))
+		if !slices.Equal(actual, test.expected) {
+			t.Errorf("parseGroupIds(%q) = %q, wanted %s", test.in, actual, test.expected)
+		}
+	}
+}