diff --git a/qa/workunits/rbd/copy.sh b/qa/workunits/rbd/copy.sh
index a3334c073d6..8430fca7665 100755
--- a/qa/workunits/rbd/copy.sh
+++ b/qa/workunits/rbd/copy.sh
@@ -29,10 +29,11 @@ test_others() {
 
     # import, snapshot
     rbd import $RBD_CREATE_ARGS /tmp/img1 testimg1
-    rbd resize testimg1 --size=256
+    rbd resize testimg1 --size=256 --allow-shrink
     rbd export testimg1 /tmp/img2
     rbd snap create testimg1 --snap=snap1
-    rbd resize testimg1 --size=128
+    rbd resize testimg1 --size=128 && exit 1 || true   # shrink should fail
+    rbd resize testimg1 --size=128 --allow-shrink
     rbd export testimg1 /tmp/img3
 
     # info
diff --git a/qa/workunits/rbd/kernel.sh b/qa/workunits/rbd/kernel.sh
index 73f3dcb6b41..3786de161ec 100755
--- a/qa/workunits/rbd/kernel.sh
+++ b/qa/workunits/rbd/kernel.sh
@@ -72,7 +72,7 @@ sudo dd if=/dev/rbd/rbd/testimg1@snap1 of=/tmp/img1.snap1
 cmp /tmp/img1 /tmp/img1.snap1
 
 # resize
-rbd resize testimg1 --size=40
+rbd resize testimg1 --size=40 --allow-shrink
 echo 1 | sudo tee /sys/bus/rbd/devices/$DEV_ID1/refresh
 cat /sys/bus/rbd/devices/$DEV_ID1/size | grep 41943040
 echo 1 | sudo tee /sys/bus/rbd/devices/$DEV_ID2/refresh
diff --git a/qa/workunits/rbd/permissions.sh b/qa/workunits/rbd/permissions.sh
index 74c24c03c2b..a4b0c32fdee 100755
--- a/qa/workunits/rbd/permissions.sh
+++ b/qa/workunits/rbd/permissions.sh
@@ -64,7 +64,7 @@ test_volumes_access() {
     rbd -k $KEYRING --id volumes lock list images/foo
 
     # commands that fail with read-only access
-    ! rbd -k $KEYRING --id volumes resize -s 2 images/foo
+    ! rbd -k $KEYRING --id volumes resize -s 2 images/foo --allow-shrink
     ! rbd -k $KEYRING --id volumes snap create images/foo@2
     ! rbd -k $KEYRING --id volumes snap rollback images/foo@snap
     ! rbd -k $KEYRING --id volumes snap remove images/foo@snap