diff --git a/doc/xml/release/2020s/2026/2.60.0.xml b/doc/xml/release/2020s/2026/2.60.0.xml
index 41c13ec08..59e338d36 100644
--- a/doc/xml/release/2020s/2026/2.60.0.xml
+++ b/doc/xml/release/2020s/2026/2.60.0.xml
@@ -241,6 +241,18 @@
 
                 <p>Replace deprecated OpenSSL APIs.</p>
             </release-item>
+
+            <release-item>
+                <github-issue id="2858"/>
+                <github-pull-request id="2859"/>
+
+                <release-item-contributor-list>
+                    <release-item-contributor id="stefan.fercot"/>
+                    <release-item-reviewer id="david.steele"/>
+                </release-item-contributor-list>
+
+                <p>Allow test user names that adduser on Debian rejects.</p>
+            </release-item>
         </release-development-list>
     </release-core-list>
 
diff --git a/test/lib/command/vm/build.py b/test/lib/command/vm/build.py
index 506707eee..738f6e1af 100644
--- a/test/lib/command/vm/build.py
+++ b/test/lib/command/vm/build.py
@@ -158,6 +158,15 @@ def _user_create(os_base, name, id, group):
     if os_base == VM_OS_BASE_RHEL:
         return "adduser -g%s -u%u -N %s" % (group, id, name)
 
+    # Debian's adduser rejects usernames that do not match NAME_REGEX (e.g. containing a dot). The name mirrors the trusted host
+    # user rather than external input, so it is safe to bypass this check. Ubuntu 22.04's adduser only understands the older
+    # --force-badname spelling; 24.04 accepts both, so detect which one this image's adduser advertises.
+    if os_base == VM_OS_BASE_DEBIAN:
+        return (
+            "badname=$(adduser --help 2>&1 | grep -q -- --allow-bad-names && echo --allow-bad-names || "
+            'echo --force-badname) && adduser --uid=%u --ingroup=%s --disabled-password --gecos "" $badname %s'
+        ) % (id, group, name)
+
     return 'adduser --uid=%u --ingroup=%s --disabled-password --gecos "" %s' % (id, group, name)
 
 
diff --git a/test/src/module/test/command/vm/build_test.py b/test/src/module/test/command/vm/build_test.py
index ecdfd3f27..517f534f6 100644
--- a/test/src/module/test/command/vm/build_test.py
+++ b/test/src/module/test/command/vm/build_test.py
@@ -96,7 +96,8 @@ SCRIPT_TEST_U24 = """ && \\
 
 # Create test user
     groupadd -f -g[GROUP_ID] [GROUP] && \\
-    adduser --uid=[USER_ID] --ingroup=[GROUP] --disabled-password --gecos "" [USER] && \\
+    badname=$(adduser --help 2>&1 | grep -q -- --allow-bad-names && echo --allow-bad-names || echo --force-badname) && \
+adduser --uid=[USER_ID] --ingroup=[GROUP] --disabled-password --gecos "" $badname [USER] && \\
     mkdir -m 750 /home/[USER]/test && \\
     chown [USER]:[GROUP] /home/[USER]/test && \\