diff --git a/javatests/com/google/gerrit/acceptance/api/group/GroupsIT.java b/javatests/com/google/gerrit/acceptance/api/group/GroupsIT.java
index 940831c89a..eb3131b1c6 100644
--- a/javatests/com/google/gerrit/acceptance/api/group/GroupsIT.java
+++ b/javatests/com/google/gerrit/acceptance/api/group/GroupsIT.java
@@ -1144,8 +1144,7 @@ public class GroupsIT extends AbstractDaemonTest {
   @Sandboxed
   public void blockReviewDbUpdatesOnGroupCreation() throws Exception {
     assume().that(groupsInNoteDb()).isFalse();
-    cfg.setBoolean("user", null, "blockReviewDbGroupUpdates", true);
-    try {
+    try (AutoCloseable ctx = createBlockReviewDbGroupUpdatesContext()) {
       gApi.groups().create(name("foo"));
       fail("Expected RestApiException: Updates to groups in ReviewDb are blocked");
     } catch (RestApiException e) {
@@ -1159,8 +1158,7 @@ public class GroupsIT extends AbstractDaemonTest {
     assume().that(groupsInNoteDb()).isFalse();
     String group1 = gApi.groups().create(name("foo")).get().id;
     String group2 = gApi.groups().create(name("bar")).get().id;
-    cfg.setBoolean("user", null, "blockReviewDbGroupUpdates", true);
-    try {
+    try (AutoCloseable ctx = createBlockReviewDbGroupUpdatesContext()) {
       gApi.groups().id(group1).addGroups(group2);
       fail("Expected RestApiException: Updates to groups in ReviewDb are blocked");
     } catch (RestApiException e) {
@@ -1367,6 +1365,16 @@ public class GroupsIT extends AbstractDaemonTest {
     return groupsInNoteDb() && cfg.getBoolean(SECTION_NOTE_DB, GROUPS.key(), READ, false);
   }
 
+  private AutoCloseable createBlockReviewDbGroupUpdatesContext() {
+    cfg.setBoolean("user", null, "blockReviewDbGroupUpdates", true);
+    return new AutoCloseable() {
+      @Override
+      public void close() {
+        cfg.setBoolean("user", null, "blockReviewDbGroupUpdates", false);
+      }
+    };
+  }
+
   @Target({METHOD})
   @Retention(RUNTIME)
   private @interface IgnoreGroupInconsistencies {}
diff --git a/javatests/com/google/gerrit/acceptance/rest/account/ExternalIdIT.java b/javatests/com/google/gerrit/acceptance/rest/account/ExternalIdIT.java
index c9f9fc7fe3..3fbeb32484 100644
--- a/javatests/com/google/gerrit/acceptance/rest/account/ExternalIdIT.java
+++ b/javatests/com/google/gerrit/acceptance/rest/account/ExternalIdIT.java
@@ -34,7 +34,6 @@ import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.Iterables;
 import com.google.gerrit.acceptance.AbstractDaemonTest;
 import com.google.gerrit.acceptance.RestResponse;
-import com.google.gerrit.acceptance.Sandboxed;
 import com.google.gerrit.common.data.GlobalCapability;
 import com.google.gerrit.common.data.Permission;
 import com.google.gerrit.extensions.api.config.ConsistencyCheckInfo;
@@ -815,52 +814,49 @@ public class ExternalIdIT extends AbstractDaemonTest {
   }
 
   @Test
-  @Sandboxed
   public void checkNoReloadAfterUpdate() throws Exception {
     Set<ExternalId> expectedExtIds = new HashSet<>(externalIds.byAccount(admin.id));
-    externalIdReader.setFailOnLoad(true);
+    try (AutoCloseable ctx = createFailOnLoadContext()) {
+      // insert external ID
+      ExternalId extId = ExternalId.create("foo", "bar", admin.id);
+      extIdsUpdate.create().insert(extId);
+      expectedExtIds.add(extId);
+      assertThat(externalIds.byAccount(admin.id)).containsExactlyElementsIn(expectedExtIds);
 
-    // insert external ID
-    ExternalId extId = ExternalId.create("foo", "bar", admin.id);
-    extIdsUpdate.create().insert(extId);
-    expectedExtIds.add(extId);
-    assertThat(externalIds.byAccount(admin.id)).containsExactlyElementsIn(expectedExtIds);
+      // update external ID
+      expectedExtIds.remove(extId);
+      extId = ExternalId.createWithEmail("foo", "bar", admin.id, "foo.bar@example.com");
+      extIdsUpdate.create().upsert(extId);
+      expectedExtIds.add(extId);
+      assertThat(externalIds.byAccount(admin.id)).containsExactlyElementsIn(expectedExtIds);
 
-    // update external ID
-    expectedExtIds.remove(extId);
-    extId = ExternalId.createWithEmail("foo", "bar", admin.id, "foo.bar@example.com");
-    extIdsUpdate.create().upsert(extId);
-    expectedExtIds.add(extId);
-    assertThat(externalIds.byAccount(admin.id)).containsExactlyElementsIn(expectedExtIds);
-
-    // delete external ID
-    extIdsUpdate.create().delete(extId);
-    expectedExtIds.remove(extId);
-    assertThat(externalIds.byAccount(admin.id)).containsExactlyElementsIn(expectedExtIds);
+      // delete external ID
+      extIdsUpdate.create().delete(extId);
+      expectedExtIds.remove(extId);
+      assertThat(externalIds.byAccount(admin.id)).containsExactlyElementsIn(expectedExtIds);
+    }
   }
 
   @Test
-  @Sandboxed
   public void byAccountFailIfReadingExternalIdsFails() throws Exception {
-    externalIdReader.setFailOnLoad(true);
+    try (AutoCloseable ctx = createFailOnLoadContext()) {
+      // update external ID branch so that external IDs need to be reloaded
+      insertExtIdBehindGerritsBack(ExternalId.create("foo", "bar", admin.id));
 
-    // update external ID branch so that external IDs need to be reloaded
-    insertExtIdBehindGerritsBack(ExternalId.create("foo", "bar", admin.id));
-
-    exception.expect(IOException.class);
-    externalIds.byAccount(admin.id);
+      exception.expect(IOException.class);
+      externalIds.byAccount(admin.id);
+    }
   }
 
   @Test
-  @Sandboxed
   public void byEmailFailIfReadingExternalIdsFails() throws Exception {
-    externalIdReader.setFailOnLoad(true);
+    try (AutoCloseable ctx = createFailOnLoadContext()) {
+      // update external ID branch so that external IDs need to be reloaded
+      insertExtIdBehindGerritsBack(ExternalId.create("foo", "bar", admin.id));
 
-    // update external ID branch so that external IDs need to be reloaded
-    insertExtIdBehindGerritsBack(ExternalId.create("foo", "bar", admin.id));
-
-    exception.expect(IOException.class);
-    externalIds.byEmail(admin.email);
+      exception.expect(IOException.class);
+      externalIds.byEmail(admin.email);
+    }
   }
 
   @Test
@@ -946,4 +942,14 @@ public class ExternalIdIT extends AbstractDaemonTest {
     assertThat(update.getStatus()).isEqualTo(Status.REJECTED_OTHER_REASON);
     assertThat(update.getMessage()).isEqualTo(msg);
   }
+
+  private AutoCloseable createFailOnLoadContext() {
+    externalIdReader.setFailOnLoad(true);
+    return new AutoCloseable() {
+      @Override
+      public void close() {
+        externalIdReader.setFailOnLoad(false);
+      }
+    };
+  }
 }