diff --git a/tests/integration/overrides/askari.yml b/tests/integration/overrides/askari.yml
index a4baf23..c0d08b3 100644
--- a/tests/integration/overrides/askari.yml
+++ b/tests/integration/overrides/askari.yml
@@ -6,3 +6,7 @@ base__firewall_apply: true
 base__ssh_listen_mesh_only: false
 # The VM is isolated; it must never touch the real mesh.
 base__mesh_enabled: false
+# Allow SSH from the VM's libvirt-NAT gateway (where the driver/ansible connects from),
+# so base's default-deny firewall + the reboot don't lock out the harness. By source IP,
+# so it's interface-independent. Overrides askari's real control addr for the test only.
+base__firewall_control_addr: "192.168.150.1"