diff --git a/manifest.yaml b/manifest.yaml
index b021aeffcc..64a97dd239 100644
--- a/manifest.yaml
+++ b/manifest.yaml
@@ -26,6 +26,11 @@ add-commit-metadata:
 packages:
  - microdnf
 
+# Scripts for opting into staying on iptables-legacy after migration. Lower into
+# `fedora-coreos-base.yaml` once we're ready to migrate `testing`.
+ostree-layers:
+  - overlay/35coreos-iptables
+
 postprocess:
   # Disable Zincati and fedora-coreos-pinger on non-production streams
   # https://github.com/coreos/fedora-coreos-tracker/issues/163