diff --git a/accesscontroltool-bundle/src/main/java/biz/netcentric/cq/tools/actool/helper/runtime/RuntimeHelper.java b/accesscontroltool-bundle/src/main/java/biz/netcentric/cq/tools/actool/helper/runtime/RuntimeHelper.java
index 3db3f0be..feb262a2 100644
--- a/accesscontroltool-bundle/src/main/java/biz/netcentric/cq/tools/actool/helper/runtime/RuntimeHelper.java
+++ b/accesscontroltool-bundle/src/main/java/biz/netcentric/cq/tools/actool/helper/runtime/RuntimeHelper.java
@@ -45,8 +45,8 @@ public static boolean isAppsReadOnly(Session session) {
             // see https://issues.apache.org/jira/browse/OAK-6563
             boolean hasCapability = session.hasCapability("addNode", appsNode, new Object[] { "nt:folder" });
             
-            boolean isCompositeNode = hasPermission && !hasCapability;
-            return isCompositeNode;
+            boolean isAppsReadOnly = hasPermission && !hasCapability;
+            return isAppsReadOnly;
         } catch(Exception e) {
             throw new IllegalStateException("Could not check if session is connected to a composite node store: "+e, e);
         }
diff --git a/accesscontroltool-startuphook-bundle/src/test/java/biz/netcentric/cq/tools/actool/startuphook/impl/AcToolStartupHookServiceImplTest.java b/accesscontroltool-startuphook-bundle/src/test/java/biz/netcentric/cq/tools/actool/startuphook/impl/AcToolStartupHookServiceImplTest.java
index 7e260253..3cf1d6dc 100644
--- a/accesscontroltool-startuphook-bundle/src/test/java/biz/netcentric/cq/tools/actool/startuphook/impl/AcToolStartupHookServiceImplTest.java
+++ b/accesscontroltool-startuphook-bundle/src/test/java/biz/netcentric/cq/tools/actool/startuphook/impl/AcToolStartupHookServiceImplTest.java
@@ -19,6 +19,8 @@
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.CsvSource;
 import org.mockito.Mock;
 import org.mockito.MockedStatic;
 import org.mockito.Mockito;
@@ -29,9 +31,12 @@
 import org.osgi.framework.FrameworkUtil;
 import org.osgi.framework.startlevel.FrameworkStartLevel;
 
+import javax.jcr.Node;
+import javax.jcr.NodeIterator;
 import javax.jcr.RepositoryException;
 import javax.jcr.Session;
 
+import static org.apache.sling.api.resource.runtime.dto.AuthType.no;
 import static org.mockito.Mockito.*;
 
 @ExtendWith(MockitoExtension.class)
@@ -46,20 +51,33 @@ class AcToolStartupHookServiceImplTest {
     @Mock
     AcToolStartupHookServiceImpl.Config config;
 
+    @Mock
+    Session session;
+
     @Mock
     SlingRepository repository;
 
+    @Mock
+    Node rootNode;
+
+    @Mock
+    NodeIterator noChildren;
+
     @Spy
     AcInstallationService installationService;
 
-    @BeforeEach
-    void setup() throws RepositoryException {
+    void setup(boolean canReadApps) throws RepositoryException {
         FrameworkStartLevel startLevel = Mockito.mock(FrameworkStartLevel.class);
         when(startLevel.getStartLevel()).thenReturn(0);
 
         when(config.activationMode()).thenReturn(AcToolStartupHookServiceImpl.Config.StartupHookActivation.ALWAYS);
 
-        Session session = mock(Session.class);
+        when(session.hasPermission("/", Session.ACTION_SET_PROPERTY)).thenReturn(canReadApps);
+        if (canReadApps) {
+            when(noChildren.hasNext()).thenReturn(false);
+            when(rootNode.getNodes()).thenReturn(noChildren);
+            when(session.getRootNode()).thenReturn(rootNode);
+        }
         when(repository.loginService(null, null)).thenReturn(session);
 
         when(bundle.getBundleContext()).thenReturn(bundleContext);
@@ -70,19 +88,24 @@ void setup() throws RepositoryException {
         when(bundleContext.getBundle(anyLong())).thenReturn(bundle);
     }
 
-    @Test
-    void testActivationSync() {
-        try (MockedStatic<FrameworkUtil> mockedFrameworkUtil = mockStatic(FrameworkUtil.class)) {
-            createAndActivateStartupHookService(mockedFrameworkUtil, false);
-            verify(installationService, times(1)).apply(null,  new String[]{}, true);
-        }
-    }
-
-    @Test
-    void testActivationAsync() {
+    @ParameterizedTest
+    @CsvSource({
+            "false, false, true",
+            "false, true, false",
+            "true, false, true"
+            // "true, true, false"
+            /*
+                last case is excluded, because it starts a thread in AcToolStartupHookServiceImpl#runAcToolAsync
+                so AcToolStartupHookServiceImpl#apply is invoked asynchronously and can not be checked easily in
+                unit test
+             */
+
+    })
+    void testActivationSync(boolean runAsync, boolean canReadApps, boolean pathsForInstallationEmpty) throws RepositoryException {
+        setup(canReadApps);
         try (MockedStatic<FrameworkUtil> mockedFrameworkUtil = mockStatic(FrameworkUtil.class)) {
-            createAndActivateStartupHookService(mockedFrameworkUtil, true);
-            verify(installationService, times(1)).apply(null,  new String[]{}, true);
+            createAndActivateStartupHookService(mockedFrameworkUtil, runAsync);
+            verify(installationService, times(1)).apply(null,  pathsForInstallationEmpty ? new String[]{} : new String[]{ "^/$", "^$" }, true);
         }
     }