Strange, but after a reboot to the same prefix, it allowed me to flash it without any "capabilities" and with enforcing SELinux. And everything worked perfectly as intended. I've no idea what caused it to not work on the first try, maybe I had to restart the shell?
Anyway, to boot into the same prefix on the next re/boot, you should set the active boot slot using bootctl set-active-boot-slot `bootctl get-current-slot`