diff --git a/test/vm.install b/test/vm.install
index fbbc62c9..b5d9cabe 100755
--- a/test/vm.install
+++ b/test/vm.install
@@ -23,6 +23,12 @@ Delegate=cpu cpuset io memory pids
 EOF
 fi
 
+if grep -q platform:el10 /usr/lib/os-release; then
+    # HACK: unbreak container port forwarding to localhost
+    # https://firewalld.org/2024/11/strict-forward-ports and https://github.com/firewalld/firewalld/issues/1380
+    sed -i 's/StrictForwardPorts=yes/StrictForwardPorts=no/' /etc/firewalld/firewalld.conf
+fi
+
 # don't force https:// (self-signed cert)
 mkdir -p /etc/cockpit
 printf "[WebService]\\nAllowUnencrypted=true\\n" > /etc/cockpit/cockpit.conf