diff --git a/config/common-dualstack.cfg b/config/common-dualstack.cfg
index 0d275f02..99e00014 100644
--- a/config/common-dualstack.cfg
+++ b/config/common-dualstack.cfg
@@ -6,3 +6,5 @@
 
 # TODO remove when ipAddressSelectionPolicy is available in compute v1
 --compute_api_version=v1beta
+
+--ensure_firewall