diff --git a/cli/user.py b/cli/user.py
index 8107b3a..8529b8d 100644
--- a/cli/user.py
+++ b/cli/user.py
@@ -243,6 +243,9 @@ def _usernamesToFile(usernames, args):
             from sqlalchemy import insert
             eid = makeEidEx(0, PrivateFIDs.IPMSUBTREE)
             res = client.setFolderMembers(eid, usernames, Permissions.STOREACCESS_SET)
+            # Remove GROMOXSTOREOWNER legacy bit used by AAPI up to version 1.20
+            # from every member, for the same reason as in setUserStoreAccessMulti.
+            client.setFolderMembers(eid, [], Permissions.GROMOXSTOREOWNER)
             if DB.minVersion(91):
                 UserSecondaryStores.query.filter(UserSecondaryStores.secondaryID == user.ID).delete(synchronize_session=False)
                 if len(usernames):
diff --git a/endpoints/domain/users.py b/endpoints/domain/users.py
index 85ce06f..5897689 100644
--- a/endpoints/domain/users.py
+++ b/endpoints/domain/users.py
@@ -540,8 +540,10 @@ def setUserStoreAccessMulti(domainID, userID):
         client = exmdb.user(user)
         res = client.setFolderMembers(eid, [user.username for user in primary], Permissions.STOREACCESS_SET)
         # Remove GROMOXSTOREOWNER legacy bit used by AAPI up to version 1.20.
-        for prim in primary:
-            client.setFolderMember(eid, prim.username, Permissions.GROMOXSTOREOWNER, client.REMOVE)
+        # An empty list clears the bit from every member, so a grant that is
+        # revoked by omission loses it as well - iterating over the requested
+        # users would leave the revoked ones a store owner.
+        client.setFolderMembers(eid, [], Permissions.GROMOXSTOREOWNER)
     if DB.minVersion(91):
         UserSecondaryStores.query.filter(UserSecondaryStores.secondaryID == user.ID).delete(synchronize_session=False)
         if len(primary):