diff --git a/BUILD b/BUILD
index d6d4eeb..9ccdae9 100644
--- a/BUILD
+++ b/BUILD
@@ -1,4 +1,5 @@
-load("//tools/bzl:plugin.bzl", "gerrit_plugin")
+load("//tools/bzl:junit.bzl", "junit_tests")
+load("//tools/bzl:plugin.bzl", "gerrit_plugin", "PLUGIN_DEPS", "PLUGIN_TEST_DEPS")
 
 gerrit_plugin(
     name = "singleusergroup",
@@ -9,3 +10,13 @@
     ],
     resources = glob(["src/main/resources/**/*"]),
 )
+
+junit_tests(
+    name = "singleusergroup_tests",
+    srcs = glob(["src/test/java/**/*Test.java"]),
+    tags = ["replication"],
+    visibility = ["//visibility:public"],
+    deps = PLUGIN_TEST_DEPS + PLUGIN_DEPS + [
+        ":singleusergroup__plugin",
+    ],
+)
diff --git a/src/main/java/com/googlesource/gerrit/plugins/singleusergroup/SingleUserGroup.java b/src/main/java/com/googlesource/gerrit/plugins/singleusergroup/SingleUserGroup.java
index a61c851..bfe18c1 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/singleusergroup/SingleUserGroup.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/singleusergroup/SingleUserGroup.java
@@ -24,23 +24,25 @@
 import com.google.gerrit.common.data.GroupDescription;
 import com.google.gerrit.common.data.GroupReference;
 import com.google.gerrit.extensions.registration.DynamicSet;
+import com.google.gerrit.index.query.QueryParseException;
 import com.google.gerrit.reviewdb.client.Account;
 import com.google.gerrit.reviewdb.client.AccountGroup;
 import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.account.AbstractGroupBackend;
 import com.google.gerrit.server.account.AccountCache;
 import com.google.gerrit.server.account.AccountState;
-import com.google.gerrit.server.account.ExternalId;
 import com.google.gerrit.server.account.GroupBackend;
 import com.google.gerrit.server.account.GroupMembership;
 import com.google.gerrit.server.account.ListGroupMembership;
-import com.google.gerrit.server.project.ProjectControl;
-import com.google.gerrit.server.query.QueryParseException;
+import com.google.gerrit.server.account.externalids.ExternalId;
+import com.google.gerrit.server.project.ProjectState;
+import com.google.gerrit.server.query.account.AccountPredicates;
 import com.google.gerrit.server.query.account.AccountQueryBuilder;
 import com.google.gerrit.server.query.account.AccountQueryProcessor;
 import com.google.gwtorm.server.OrmException;
 import com.google.inject.AbstractModule;
 import com.google.inject.Inject;
+import com.google.inject.Provider;
 import com.google.inject.Singleton;
 import java.util.Collection;
 import java.util.Collections;
@@ -72,16 +74,16 @@
 
   private final AccountCache accountCache;
   private final AccountQueryBuilder queryBuilder;
-  private final AccountQueryProcessor queryProcessor;
+  private final Provider<AccountQueryProcessor> queryProvider;
 
   @Inject
   SingleUserGroup(
       AccountCache accountCache,
       AccountQueryBuilder queryBuilder,
-      AccountQueryProcessor queryProcessor) {
+      Provider<AccountQueryProcessor> queryProvider) {
     this.accountCache = accountCache;
     this.queryBuilder = queryBuilder;
-    this.queryProcessor = queryProcessor;
+    this.queryProvider = queryProvider;
   }
 
   @Override
@@ -90,7 +92,7 @@
   }
 
   @Override
-  public GroupMembership membershipsOf(final IdentifiedUser user) {
+  public GroupMembership membershipsOf(IdentifiedUser user) {
     ImmutableList.Builder<AccountGroup.UUID> groups = ImmutableList.builder();
     groups.add(uuid(user.getAccountId()));
     if (user.getUserName() != null) {
@@ -100,7 +102,7 @@
   }
 
   @Override
-  public GroupDescription.Basic get(final AccountGroup.UUID uuid) {
+  public GroupDescription.Basic get(AccountGroup.UUID uuid) {
     String ident = username(uuid);
     AccountState state;
     if (ident.matches(ACCOUNT_ID_PATTERN)) {
@@ -141,10 +143,14 @@
   }
 
   @Override
-  public Collection<GroupReference> suggest(String name, @Nullable ProjectControl project) {
+  public Collection<GroupReference> suggest(String name, @Nullable ProjectState project) {
     try {
       return Lists.transform(
-          queryProcessor.setLimit(MAX).query(queryBuilder.defaultQuery(name)).entities(),
+          queryProvider
+              .get()
+              .setUserProvidedLimit(MAX)
+              .query(AccountPredicates.andActive(queryBuilder.defaultQuery(name)))
+              .entities(),
           new Function<AccountState, GroupReference>() {
             @Override
             public GroupReference apply(AccountState state) {
diff --git a/src/test/java/com/googlesource/gerrit/plugins/singleusergroup/SingleUserGroupTest.java b/src/test/java/com/googlesource/gerrit/plugins/singleusergroup/SingleUserGroupTest.java
new file mode 100644
index 0000000..9bc8859
--- /dev/null
+++ b/src/test/java/com/googlesource/gerrit/plugins/singleusergroup/SingleUserGroupTest.java
@@ -0,0 +1,38 @@
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.googlesource.gerrit.plugins.singleusergroup;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import com.google.gerrit.acceptance.LightweightPluginDaemonTest;
+import com.google.gerrit.acceptance.NoHttpd;
+import com.google.gerrit.acceptance.TestPlugin;
+import com.google.gerrit.extensions.common.GroupInfo;
+import java.util.Map;
+import org.junit.Test;
+
+@NoHttpd
+@TestPlugin(
+    name = "singleusergroup",
+    sysModule = "com.googlesource.gerrit.plugins.singleusergroup.SingleUserGroup$Module")
+public class SingleUserGroupTest extends LightweightPluginDaemonTest {
+  @Test
+  public void testSuggestion() throws Exception {
+    // No ability to modify account and therefore no ACL to see secondary email
+    setApiUser(user);
+    Map<String, GroupInfo> groups = gApi.groups().list().withSuggest("adm").getAsMap();
+    assertThat(groups).containsKey("user/Administrator (admin)");
+  }
+}