Setcap causes problems (like issue #1007), so stop using it (and undo the permission override on upgrade) and instead set capabilities via the systemd services. (This also fixes some AssertFileNotEmpty declarations that were in the wrong places).
They belong in the [Unit] section, not the [Service] section.