diff --git a/ci/setup_accounts.sh b/ci/setup_accounts.sh
index 17f03159..1873c4b2 100755
--- a/ci/setup_accounts.sh
+++ b/ci/setup_accounts.sh
@@ -7,3 +7,12 @@ sqlplus system/${DATABASE_SYS_PASSWORD}@${DATABASE_NAME} <<SQL
 @@spec/support/create_arunit_user.sql
 exit
 SQL
+
+# `grant execute on dbms_lock` requires SYS in 12c+; SYSTEM no longer has the
+# privilege. Run it through a separate `as sysdba` session so the same script
+# works on both gvenzl/oracle-xe:11 and gvenzl/oracle-free.
+sqlplus -s sys/${DATABASE_SYS_PASSWORD}@${DATABASE_NAME} as sysdba <<SQL
+whenever sqlerror exit failure
+grant execute on dbms_lock to hr;
+exit
+SQL
diff --git a/spec/support/unlock_and_setup_hr_user.sql b/spec/support/unlock_and_setup_hr_user.sql
index 1cd91154..ee117ddf 100644
--- a/spec/support/unlock_and_setup_hr_user.sql
+++ b/spec/support/unlock_and_setup_hr_user.sql
@@ -1,4 +1,3 @@
 create user hr identified by hr;
 alter user hr identified by hr account unlock;
 grant dba to hr;
-grant execute on dbms_lock to hr;