diff --git a/nix/agent-modules/network.nix b/nix/agent-modules/network.nix
index e51909e0..64adf66b 100644
--- a/nix/agent-modules/network.nix
+++ b/nix/agent-modules/network.nix
@@ -2,6 +2,7 @@
 # taken out of the loop, and the oneshot that points resolv.conf at
 # the hive bridge resolver.
 {
+  config,
   pkgs,
   lib,
   ...
@@ -26,6 +27,15 @@
     networking.resolvconf.enable = false;
     networking.dhcpcd.extraConfig = "nohook resolv.conf";
 
+    # A unicast DHCP renewal reply otherwise reaches dhcpcd only by
+    # matching the firewall's ESTABLISHED,RELATED conntrack rule against
+    # the outbound request; when that conntrack entry has already expired
+    # the reply is dropped with no log line anywhere. Accept it
+    # unconditionally instead, removing that dependency. Not a fix for any
+    # particular observed failure — the reply path just shouldn't depend
+    # on conntrack state in the first place.
+    networking.firewall.allowedUDPPorts = lib.mkIf config.networking.firewall.enable [ 68 ];
+
     # Point resolv.conf at the hive bridge resolver when the container is
     # network-isolated. nixos-container copies the *host's* /etc/resolv.conf
     # into the container at every start — but the host resolver (e.g.