diff --git a/image/overlay/etc/nftables.nft b/image/overlay/etc/nftables.nft
index c3e7e12..25b3516 100644
--- a/image/overlay/etc/nftables.nft
+++ b/image/overlay/etc/nftables.nft
@@ -64,7 +64,8 @@ table inet filter {
 		ip6 saddr fe80::/10 udp sport 547 udp dport 546 accept \
 		comment "Accept DHCPv6 replies from IPv6 link-local addresses"
 
-        ip daddr != 172.16.0.0/12 tcp dport { 22, 2222 } accept comment "SSH"
+        ip daddr != 172.16.0.0/12 tcp dport 2222 accept comment "SSH"
+		tcp dport 22 accept comment "bubble ssh"
         udp dport 41641 accept comment "Tailscale"
 		ip saddr 172.16.0.0/12 tcp dport 7684 accept comment "bubble management"
 	}