diff --git a/os/mkosi/components/kernel/kernel.config b/os/mkosi/components/kernel/kernel.config
index 8b6960a4f..ef7f0db4d 100644
--- a/os/mkosi/components/kernel/kernel.config
+++ b/os/mkosi/components/kernel/kernel.config
@@ -113,6 +113,12 @@ CONFIG_NF_TABLES=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NF_NAT=m
 CONFIG_NETFILTER_XTABLES=m
+# Docker uses the iptables-nft frontend, whose compatibility path still needs
+# the xtables NAT targets to program published container ports.
+CONFIG_NETFILTER_XT_NAT=m
+CONFIG_NETFILTER_XT_TARGET_MASQUERADE=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_NETFILTER_XT_MARK=m
 CONFIG_IP_SET=m
 CONFIG_IP_VS=m
 CONFIG_IPVLAN=m