diff --git a/src/modules/users/CMakeLists.txt b/src/modules/users/CMakeLists.txt
index bf93eb26a..e2d2e3117 100644
--- a/src/modules/users/CMakeLists.txt
+++ b/src/modules/users/CMakeLists.txt
@@ -55,6 +55,7 @@ calamares_add_test(
     SOURCES
         CreateUserTests.cpp
         CreateUserJob.cpp
+        Config.cpp
 )
 
 calamares_add_test(
diff --git a/src/modules/users/Config.cpp b/src/modules/users/Config.cpp
index bb739cbd1..060600894 100644
--- a/src/modules/users/Config.cpp
+++ b/src/modules/users/Config.cpp
@@ -351,6 +351,21 @@ Config::setAutoLogin( bool b )
     }
 }
 
+STATICTEST inline void
+setConfigurationDefaultGroups( const QVariantMap& map, QStringList& defaultGroups )
+{
+    // '#' is not a valid group name; use that to distinguish an empty-list
+    // in the configuration (which is a legitimate, if unusual, choice)
+    // from a bad or missing configuration value.
+    defaultGroups = CalamaresUtils::getStringList( map, QStringLiteral( "defaultGroups" ), QStringList { "#" } );
+    if ( defaultGroups.contains( QStringLiteral( "#" ) ) )
+    {
+        cWarning() << "Using fallback groups. Please check *defaultGroups* in users.conf";
+        defaultGroups = QStringList { "lp", "video", "network", "storage", "wheel", "audio" };
+    }
+}
+
+
 void
 Config::setConfigurationMap( const QVariantMap& configurationMap )
 {
@@ -365,6 +380,7 @@ Config::setConfigurationMap( const QVariantMap& configurationMap )
     setAutologinGroup( CalamaresUtils::getString( configurationMap, "autologinGroup" ) );
     setSudoersGroup( CalamaresUtils::getString( configurationMap, "sudoersGroup" ) );
 
+    setConfigurationDefaultGroups( configurationMap, m_defaultGroups );
     m_doAutoLogin = CalamaresUtils::getBool( configurationMap, "doAutologin", false );
 
     m_writeRootPassword = CalamaresUtils::getBool( configurationMap, "setRootPassword", true );
diff --git a/src/modules/users/Config.h b/src/modules/users/Config.h
index d32ddc8f2..b84dc5aaf 100644
--- a/src/modules/users/Config.h
+++ b/src/modules/users/Config.h
@@ -77,6 +77,8 @@ public:
     /// Should the root password be written (if false, no password is set and the root account is disabled for login)
     bool writeRootPassword() const { return m_writeRootPassword; }
 
+    const QStringList& defaultGroups() const { return m_defaultGroups; }
+
     static const QStringList& forbiddenLoginNames();
     static const QStringList& forbiddenHostNames();
 
@@ -119,6 +121,7 @@ signals:
     void autoLoginChanged( bool );
 
 private:
+    QStringList m_defaultGroups;
     QString m_userShell;
     QString m_autologinGroup;
     QString m_sudoersGroup;
diff --git a/src/modules/users/CreateUserTests.cpp b/src/modules/users/CreateUserTests.cpp
index b351109b3..50592a384 100644
--- a/src/modules/users/CreateUserTests.cpp
+++ b/src/modules/users/CreateUserTests.cpp
@@ -17,6 +17,7 @@
  *   along with Calamares. If not, see <http://www.gnu.org/licenses/>.
  */
 
+#include "Config.h"
 #include "CreateUserJob.h"
 
 #include "utils/Logger.h"
@@ -25,8 +26,8 @@
 #include <QtTest/QtTest>
 
 // Implementation details
-extern QStringList groupsInTargetSystem( const QDir& targetRoot );
-
+extern QStringList groupsInTargetSystem( const QDir& targetRoot );  // CreateUserJob
+extern void setConfigurationDefaultGroups( const QVariantMap& map, QStringList& defaultGroups );
 
 class CreateUserTests : public QObject
 {
@@ -39,6 +40,7 @@ private Q_SLOTS:
     void initTestCase();
 
     void testReadGroup();
+    void testDefaultGroups();
 };
 
 CreateUserTests::CreateUserTests() {}
@@ -73,6 +75,61 @@ CreateUserTests::testReadGroup()
     }
 }
 
+void
+CreateUserTests::testDefaultGroups()
+{
+    {
+        QStringList groups;
+        QVariantMap hweelGroup;
+        QVERIFY( groups.isEmpty() );
+        hweelGroup.insert( "defaultGroups", QStringList { "hweel" } );
+        setConfigurationDefaultGroups( hweelGroup, groups );
+        QCOMPARE( groups.count(), 1 );
+        QVERIFY( groups.contains( "hweel" ) );
+    }
+
+    {
+        QStringList desired { "wheel", "root", "operator" };
+        QStringList groups;
+        QVariantMap threeGroup;
+        QVERIFY( groups.isEmpty() );
+        threeGroup.insert( "defaultGroups", desired );
+        setConfigurationDefaultGroups( threeGroup, groups );
+        QCOMPARE( groups.count(), 3 );
+        QVERIFY( !groups.contains( "hweel" ) );
+        QCOMPARE( groups, desired );
+    }
+
+    {
+        QStringList groups;
+        QVariantMap explicitEmpty;
+        QVERIFY( groups.isEmpty() );
+        explicitEmpty.insert( "defaultGroups", QStringList() );
+        setConfigurationDefaultGroups( explicitEmpty, groups );
+        QCOMPARE( groups.count(), 0 );
+    }
+
+    {
+        QStringList groups;
+        QVariantMap missing;
+        QVERIFY( groups.isEmpty() );
+        setConfigurationDefaultGroups( missing, groups );
+        QCOMPARE( groups.count(), 6 );  // because of fallback!
+        QVERIFY( groups.contains( "lp" ) );
+    }
+
+    {
+        QStringList groups;
+        QVariantMap typeMismatch;
+        QVERIFY( groups.isEmpty() );
+        typeMismatch.insert( "defaultGroups", 1 );
+        setConfigurationDefaultGroups( typeMismatch, groups );
+        QCOMPARE( groups.count(), 6 );  // because of fallback!
+        QVERIFY( groups.contains( "lp" ) );
+    }
+}
+
+
 QTEST_GUILESS_MAIN( CreateUserTests )
 
 #include "utils/moc-warnings.h"
diff --git a/src/modules/users/UsersViewStep.cpp b/src/modules/users/UsersViewStep.cpp
index ddaf4837b..b9ea3ae17 100644
--- a/src/modules/users/UsersViewStep.cpp
+++ b/src/modules/users/UsersViewStep.cpp
@@ -145,10 +145,11 @@ UsersViewStep::onLeave()
     }
 
     Calamares::Job* j;
+    // TODO: Config object should create jobs, like this one, that depend only on config values
     j = new CreateUserJob( m_config->loginName(),
                            m_config->fullName().isEmpty() ? m_config->loginName() : m_config->fullName(),
                            m_config->doAutoLogin(),
-                           m_defaultGroups );
+                           m_config->defaultGroups() );
 
     auto userPW = m_widget->getUserPassword();
     j = new SetPasswordJob( userPW.first, userPW.second );
@@ -171,17 +172,6 @@ UsersViewStep::setConfigurationMap( const QVariantMap& configurationMap )
     (void)this->widget();
     using CalamaresUtils::getBool;
 
-    if ( configurationMap.contains( "defaultGroups" )
-         && configurationMap.value( "defaultGroups" ).type() == QVariant::List )
-    {
-        m_defaultGroups = configurationMap.value( "defaultGroups" ).toStringList();
-    }
-    else
-    {
-        cWarning() << "Using fallback groups. Please check defaultGroups in users.conf";
-        m_defaultGroups = QStringList { "lp", "video", "network", "storage", "wheel", "audio" };
-    }
-
     m_widget->setReusePasswordDefault( getBool( configurationMap, "doReusePassword", false ) );
 
     if ( configurationMap.contains( "passwordRequirements" )
diff --git a/src/modules/users/UsersViewStep.h b/src/modules/users/UsersViewStep.h
index aacf11f2a..5c3674571 100644
--- a/src/modules/users/UsersViewStep.h
+++ b/src/modules/users/UsersViewStep.h
@@ -61,7 +61,6 @@ private:
     UsersPage* m_widget;
     QList< Calamares::job_ptr > m_jobs;
 
-    QStringList m_defaultGroups;
     SetHostNameJob::Actions m_actions;
 
     Config* m_config;