diff --git a/script/universal/MultisigBase.sol b/script/universal/MultisigBase.sol
index b01b522..d2d79d6 100644
--- a/script/universal/MultisigBase.sol
+++ b/script/universal/MultisigBase.sol
@@ -190,6 +190,9 @@ abstract contract MultisigBase is CommonBase {
         returns (Simulation.StateOverride memory)
     {
         uint256 _nonce = _getNonce(_safe);
+        if (_owner == address(0)) {
+            return Simulation.overrideSafeThresholdAndNonce(_safe, _nonce);
+        }
         return Simulation.overrideSafeThresholdOwnerAndNonce(_safe, _owner, _nonce);
     }
 
diff --git a/script/universal/NestedMultisigBuilder.sol b/script/universal/NestedMultisigBuilder.sol
index 4ca17dc..c977885 100644
--- a/script/universal/NestedMultisigBuilder.sol
+++ b/script/universal/NestedMultisigBuilder.sol
@@ -218,7 +218,7 @@ abstract contract NestedMultisigBuilder is MultisigBase {
         Simulation.StateOverride[] memory simOverrides = _simulationOverrides();
         Simulation.StateOverride[] memory overrides = new Simulation.StateOverride[](2 + simOverrides.length);
         overrides[0] = _safeOverrides(_signerSafe, MULTICALL3_ADDRESS);
-        overrides[1] = _safeOverrides(_safe, msg.sender);
+        overrides[1] = _safeOverrides(_safe, address(0));
         for (uint256 i = 0; i < simOverrides.length; i++) {
             overrides[i + 2] = simOverrides[i];
         }
diff --git a/script/universal/Simulation.sol b/script/universal/Simulation.sol
index 1954547..ca51288 100644
--- a/script/universal/Simulation.sol
+++ b/script/universal/Simulation.sol
@@ -51,6 +51,13 @@ library Simulation {
         return accesses;
     }
 
+    function overrideSafeThresholdAndNonce(address _safe, uint256 _nonce) public view returns (StateOverride memory) {
+        StateOverride memory state = StateOverride({contractAddress: _safe, overrides: new StorageOverride[](0)});
+        state = addThresholdOverride(_safe, state);
+        state = addNonceOverride(_safe, state, _nonce);
+        return state;
+    }
+
     function overrideSafeThresholdOwnerAndNonce(address _safe, address _owner, uint256 _nonce)
         public
         view