Please make sure SSSD cache is only flushed by pwck/grpck when it is really needed.

Note that's not an issue on RHEL 9/10 where integration with SSSD is disabled by default.

If possible, probably the best would be to disable this integration by default on RHEL8 as well. If not possible, then shipping https://github.com/shadow-maint/shadow/commit/ce66b8d5eb2c12356fd2975ff2d7d6eeaed7d6a8 is also an option.