diff --git a/minimal/bootc.yaml b/minimal/bootc.yaml
index 5cecefb..d98497d 100644
--- a/minimal/bootc.yaml
+++ b/minimal/bootc.yaml
@@ -2,15 +2,15 @@
 packages:
  - systemd
  - bootc
- # bootc pulls in podman, which pulls in containers-common, which wants
- # `iptables`. Currently that pulls in iptables-legacy. Let's explicitly name
- # iptables-nft instead to satisfy it.
- - iptables-nft
  # Required by bootc install, sgdisk has been replaced by Rust crate
  # in bootc https://github.com/containers/bootc/pull/775
  - xfsprogs e2fsprogs dosfstools
 
 exclude-packages:
+  # bootc pulls in podman, which pulls in containers-common, which wants
+  # `iptables`. That may pull in iptables-legacy which we don't want;
+  # we want iptables-nft to win the Provides by default
+  - iptables-legacy
   # Exclude kernel-debug-core to make sure that it doesn't somehow get
   # chosen as the package to satisfy the `kernel-core` dependency from
   # the kernel package.