diff --git a/.github/workflows/job-test-in-container.yml b/.github/workflows/job-test-in-container.yml
index da776b86db5..be742f8ab00 100644
--- a/.github/workflows/job-test-in-container.yml
+++ b/.github/workflows/job-test-in-container.yml
@@ -70,6 +70,10 @@ jobs:
       - name: "Init: expose GitHub Runtime variables for gha"
         uses: crazy-max/ghaction-github-runtime@3cb05d89e1f492524af3d41a1c98c83bc3025124  # v3.1.0
 
+      - name: "Init: install br-netfilter"
+        run: |
+          # This ensures that bridged traffic goes through netfilter
+          sudo modprobe br-netfilter
       - name: "Init: register QEMU (tonistiigi/binfmt)"
         run: |
           # `--install all` will only install emulation for architectures that cannot be natively executed
diff --git a/.github/workflows/job-test-in-host.yml b/.github/workflows/job-test-in-host.yml
index 932a070e00d..5d944a72dab 100644
--- a/.github/workflows/job-test-in-host.yml
+++ b/.github/workflows/job-test-in-host.yml
@@ -156,6 +156,9 @@ jobs:
           sudo apt-get install -qq expect
           echo "::endgroup::"
 
+          # This ensures that bridged traffic goes through netfilter
+          sudo modprobe br-netfilter
+
       - if: ${{ contains(inputs.runner, 'windows') && env.SHOULD_RUN == 'yes' }}
         name: "Init (windows): prepare host"
         env: