diff --git a/debian/iscsid.service b/debian/iscsid.service
index d05953d..4f5edeb 100644
--- a/debian/iscsid.service
+++ b/debian/iscsid.service
@@ -7,6 +7,7 @@ After=network.target network-online.target
 DefaultDependencies=no
 Conflicts=shutdown.target
 Before=shutdown.target
+ConditionVirtualization=!container
 
 [Service]
 Type=forking
diff --git a/debian/open-iscsi.service b/debian/open-iscsi.service
index c670b16..3560324 100644
--- a/debian/open-iscsi.service
+++ b/debian/open-iscsi.service
@@ -7,7 +7,6 @@ Before=remote-fs-pre.target
 DefaultDependencies=no
 Conflicts=shutdown.target
 Before=shutdown.target
-ConditionVirtualization=!container
 
 [Service]
 Type=oneshot
@@ -15,7 +14,9 @@ RemainAfterExit=true
 # iscsiadm --login will return 21 if no nodes are configured,
 # and 15 if a session is alread logged in (which we do not
 # consider an error)
-SuccessExitStatus=15 21
+# systemctl returning 3 indicates that iscsid was prevented from
+# starting due to a condition
+SuccessExitStatus=3 15 21
 # iscsiadm will only work if iscsid is running. But we can't use a
 # Requires= dependency, since restarts of iscsid would then be
 # propagated to this service - and that would cause all sorts of