diff --git a/roles/configuration/tasks/firewall.yml b/roles/configuration/tasks/firewall.yml
index 0f1c7dd..ebfc8aa 100644
--- a/roles/configuration/tasks/firewall.yml
+++ b/roles/configuration/tasks/firewall.yml
@@ -12,6 +12,21 @@
     and 'No such file or directory' not in (_firewall_enable.stderr | default(''))
     and 'does not exist' not in (_firewall_enable.stderr | default(''))
 
+# Distro base sets ship the daemon preset-enabled (RHEL @core pulls firewalld in),
+# so opting out has to disable the unit, not merely skip enabling it.
+- name: Disable the firewall daemon in the install chroot
+  when:
+    - firewall_phase == 'install'
+    - _configuration_platform.init_system == 'systemd'
+    - not system_cfg.features.firewall.enabled | bool
+  ansible.builtin.command: "{{ chroot_command }} systemctl disable {{ system_cfg.features.firewall.backend }}"
+  register: _firewall_disable
+  changed_when: "'Removed' in (_firewall_disable.stderr | default(''))"
+  failed_when: >-
+    _firewall_disable.rc != 0
+    and 'No such file or directory' not in (_firewall_disable.stderr | default(''))
+    and 'does not exist' not in (_firewall_disable.stderr | default(''))
+
 # ufw's CLI needs a running kernel and is a no-op in the chroot (leaves ENABLED=no),
 # so its activation and SSH rule are applied here, after reboot.
 - name: Allow SSH through ufw before enabling