the `system:` prefix was missing, but I've resolved it here: ea67a50ce44a6c302e7f39193cc8141a4c2b6053