diff --git a/roles/reproducer/tasks/ocp_layout.yml b/roles/reproducer/tasks/ocp_layout.yml
index 7d305891a..274ea277b 100644
--- a/roles/reproducer/tasks/ocp_layout.yml
+++ b/roles/reproducer/tasks/ocp_layout.yml
@@ -396,6 +396,21 @@
         immediate: true
         permanent: true
 
+    # On NAT64/IPv6 jobs the OCP nodes reach the host registry through the
+    # 'libvirt' zone, which dev-scripts doesn't open (it covers only the 'public'
+    # zone and the IPv4 'libvirt-to-host' policy), so the bootstrap can't pull the
+    # release image and node-image-pull wedges the install (OSPCIX-1526). Open the
+    # port on the libvirt zone for NAT64 jobs and keep it for the whole deploy.
+    - name: Allow libvirt zone on the dev-scripts local registry port (NAT64/IPv6)
+      when: cifmw_use_nat64 | default(false) | bool
+      become: true
+      ansible.posix.firewalld:
+        port: "5000/tcp"
+        zone: libvirt
+        state: enabled
+        immediate: true
+        permanent: true
+
     - name: Run devscripts role
       ansible.builtin.include_role:
         name: devscripts