diff --git a/src/acl.c b/src/acl.c
index 8572bd1..54c4e15 100644
--- a/src/acl.c
+++ b/src/acl.c
@@ -2214,6 +2214,11 @@
 				}
 			} /* end of args processing */
 
+			/* don't try to resolve groups if we're not certain of having
+			 * resolved userlists first.
+			 */
+			if (cfgerr)
+				break;
 
 			if (!strcmp(expr->kw->kw, "http_auth_group")) {
 				/* note: argument resolved above thanks to ARGT_USR */