diff --git a/minimal/bootc.yaml b/minimal/bootc.yaml
index d98497d..a2500ce 100644
--- a/minimal/bootc.yaml
+++ b/minimal/bootc.yaml
@@ -7,10 +7,6 @@ packages:
  - xfsprogs e2fsprogs dosfstools
 
 exclude-packages:
-  # bootc pulls in podman, which pulls in containers-common, which wants
-  # `iptables`. That may pull in iptables-legacy which we don't want;
-  # we want iptables-nft to win the Provides by default
-  - iptables-legacy
   # Exclude kernel-debug-core to make sure that it doesn't somehow get
   # chosen as the package to satisfy the `kernel-core` dependency from
   # the kernel package.
diff --git a/tests/rootfs/cases/no-iptables-legacy b/tests/rootfs/cases/no-iptables-legacy
new file mode 100755
index 0000000..0100c5d
--- /dev/null
+++ b/tests/rootfs/cases/no-iptables-legacy
@@ -0,0 +1,4 @@
+#!/bin/bash
+set -xeuo pipefail
+output=$(rpm -q iptables-legacy || true)
+grep "is not installed" <<< "$output"