diff --git a/src/shared/tar-util.c b/src/shared/tar-util.c
index f3b63fe98f..1ba569e734 100644
--- a/src/shared/tar-util.c
+++ b/src/shared/tar-util.c
@@ -1341,7 +1341,7 @@ static int archive_write_acl(
                 assert_cc(ACL_UNDEFINED_TAG == 0);   /* safety check, we assume that holes are filled with ACL_UNDEFINED_TAG */
                 assert_cc(ELEMENTSOF(tag_map) <= 64); /* safety check, we assume that the tag ids are all packed and low */
 
-                int tag = ntag >= 0 && ntag <= (acl_tag_t) ELEMENTSOF(tag_map) ? tag_map[ntag] : ACL_UNDEFINED_TAG;
+                int tag = ntag >= 0 && ntag < (acl_tag_t) ELEMENTSOF(tag_map) ? tag_map[ntag] : ACL_UNDEFINED_TAG;
 
                 bool skip = false;
                 id_t qualifier = UID_INVALID;