diff --git a/CHANGELOG.md b/CHANGELOG.md
index a15324d7..bbcf4532 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -54,7 +54,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ### Changed
 
-- Ignore +:::: lines in passwd/group during syncuser. #1286
+- Explicitly ignore compat-style NIS lines in passwd/group during syncuser. #1286
 
 ## v4.5.4, 2024-06-12
 
diff --git a/internal/pkg/container/syncuids.go b/internal/pkg/container/syncuids.go
index 74581e02..7bb19153 100644
--- a/internal/pkg/container/syncuids.go
+++ b/internal/pkg/container/syncuids.go
@@ -177,7 +177,8 @@ func (db syncDB) read(fileName string, fromContainer bool) error {
 				continue
 			}
 			// ignore ldap/nis/sssd line
-			if fields[0] == "+" {
+			if strings.HasPrefix(fields[0], "+") || strings.HasPrefix(fields[0], "-") {
+				wwlog.Verbose("Ignoring line %s (unhandled compat-style NIS reference)", line)
 				continue
 			}
 			id, err := strconv.Atoi(fields[2])
diff --git a/internal/pkg/container/syncuids_test.go b/internal/pkg/container/syncuids_test.go
index 86242f5a..efd3c6f3 100644
--- a/internal/pkg/container/syncuids_test.go
+++ b/internal/pkg/container/syncuids_test.go
@@ -275,11 +275,13 @@ func Test_network_passwd(t *testing.T) {
 	buf := new(bytes.Buffer)
 	wwlog.SetLogWriter(buf)
 	hostInput := `testuser1:x:1001:1001::/home/testuser:/bin/bash
-+::::::`
++::::::
+-::::::`
 	hostFileName := writeTempFile(t, hostInput)
 	defer os.Remove(hostFileName)
 	db := make(syncDB)
 	err := db.readFromHost(hostFileName)
 	assert.NotContains(t, buf.String(), "parse error")
+	assert.Contains(t, buf.String(), "Ignoring line")
 	assert.NoError(t, err)
 }