@@ -62,7 +62,7 @@ its own files.
 | `sci-22-storage` | multipath, iSCSI and NFS client tuning | `base` |
 | `sci-40-libvirt` | the hypervisor-agnostic libvirt daemon and clients, with vTPM | `base` |
 | `sci-50-virt-ch` | the Cloud Hypervisor driver and its firmware | `base` |
-| `sci-51-virt-qemu` | the qemu flavour: driver and userland | `base` |
+| `sci-51-virt-qemu` | the qemu flavour: driver and userland, plus the VNC port policy for `etc/libvirt/qemu.conf` | `base` |
 
 **The prefixes encode the merge order.** systemd-sysext merges the
 deployed raws (`/var/lib/extensions/<name>.raw`) in lexical filename
@@ -419,6 +419,15 @@ and kmod already read. That keeps `/etc` writable and avoids confext.
 Confext is not used: it mounts `/etc` read-only while merged, the
 riskiest semantic, and oneshot units cover the need.
 
+The one `/etc` file with no `/usr` fallback is libvirt's
+`qemu.conf`. The qemu extension ships a template under
+`usr/share/sci/etc/` and its tmpfiles fragment carries
+`C /etc/libvirt/qemu.conf`, which the libvirt activation shim applies
+after the merge and before `libvirtd` starts. Type `C` is copy-once:
+the first activation creates the file, later activations leave
+operator edits alone, and a policy change needs the file deleted or
+the rule moved to `C+`.
+
 **Payload fragment filenames are not identities.** The sci-prefixed
 fragments keep their pre-rename stems on purpose:
 `usr/lib/sysusers.d/sci-compute.conf`,
@@ -897,14 +906,16 @@ ignition-capable USI base.
 - **Single owner per path.** Overlay shadowing is silent. One owner
   plus the artifact and guest contracts is the only way to keep
   identities and configs from diverging across hosts.
-- **`/etc` content needs its own carrier.** A sysext merges `/usr`
-  only, so configuration the legacy image baked into `/etc` has no
-  delivery path here. The qemu driver's VNC port range in
-  `/etc/libvirt/qemu.conf` is the canonical case. Configuration
-  extensions (confexts) are the candidate mechanism. The 2150 base
-  ships `systemd-confext` (systemd 259.7), so the runtime support
-  exists. Whether confexts arrive as a separate artifact set or as
-  manifest entries is an open design decision.
+- **`/etc` content has narrow carriers.** A sysext merges `/usr` only.
+  Most configuration has a `/usr/lib` fallback, and the one file that
+  does not — libvirt's `qemu.conf` — is materialized at activation by a
+  tmpfiles `C` rule from a template in the qemu extension. That carrier
+  is copy-once and fits single files. Broader `/etc` content still needs
+  a decision: confexts can carry it, but a merged confext mounts `/etc`
+  read-only, the riskiest semantic for a hypervisor host. The 2150 base
+  ships `systemd-confext` (259.7), so the runtime support exists.
+  Whether confexts arrive as a separate artifact set or as manifest
+  entries remains open.
 - **Sequential composition over one big image.** Separating identities,
   networking, storage and libvirt means a change to one does not churn
   the others. `sci-20-compute` keeps the chart-consumed UID contract
 
@@ -62,6 +62,11 @@ def test_delivery_and_host_contract():
     first = run("bash", str(staging / "sci-delivery.sh"), env=env)
     assert first.returncode == 0, first.stdout + first.stderr
     assert merged_extensions() == EXTENSIONS
+    qemu_conf = Path("/etc/libvirt/qemu.conf")
+    assert qemu_conf.is_file() and not qemu_conf.is_symlink(), qemu_conf
+    qemu_text = qemu_conf.read_text()
+    assert "remote_display_port_min = 32200" in qemu_text
+    assert "remote_display_port_max = 32299" in qemu_text
     assert {p: Path(p).read_bytes() for p in base} == base
     # (uid, home, shell) as the sysusers fragments declare; libvirt-qemu's '-' is the default.
     identities = {
@@ -134,7 +139,31 @@ def test_delivery_and_host_contract():
             assert not db.is_symlink() and db.read_bytes() == b"existing OVS database\n"
         else:
             assert db.is_symlink() and os.readlink(db) == "/var/lib/openvswitch/conf.db"
-    files = list(destination.glob("*.raw")) + [Path("/etc/passwd"), Path("/etc/group")]
+    # The qemu C rule copies once: absent destinations are materialized, edits survive.
+    qemu_fragment = Path("/usr/lib/tmpfiles.d/sci-virt-qemu.conf")
+    qemu_payload = Path("/usr/share/sci/etc/libvirt/qemu.conf")
+    assert qemu_fragment.is_file(), qemu_fragment
+    assert qemu_payload.is_file(), qemu_payload
+    for existing in (True, False):
+        root = scratch / f"qemu-{existing}"
+        source = root / "usr/share/sci/etc/libvirt/qemu.conf"
+        source.parent.mkdir(parents=True)
+        source.write_bytes(qemu_payload.read_bytes())
+        target = root / "etc/libvirt/qemu.conf"
+        if existing:
+            target.parent.mkdir(parents=True)
+            target.write_bytes(b"operator override\n")
+        result = run("systemd-tmpfiles", f"--root={root}", "--create", str(qemu_fragment))
+        assert result.returncode == 0, result.stderr
+        if existing:
+            assert not target.is_symlink() and target.read_bytes() == b"operator override\n"
+        else:
+            assert target.is_file() and not target.is_symlink()
+            copied = target.read_text()
+            assert "remote_display_port_min = 32200" in copied
+            assert "remote_display_port_max = 32299" in copied
+    files = list(destination.glob("*.raw")) + [Path("/etc/passwd"), Path("/etc/group"),
+                                               Path("/etc/libvirt/qemu.conf")]
     files += [Path(f"/etc/systemd/system/{name}-activation.service")
               for name in ("sci-20-compute", "sci-21-network", "sci-22-storage", "sci-40-libvirt")]
     before = {p: (p.read_bytes(), p.stat().st_mtime_ns) for p in files}
 
@@ -31,7 +31,8 @@
                        "usr/share/cloud-hypervisor/CLOUDHV_EFI.fd"),
     "sci-51-virt-qemu": ("usr/bin/qemu-system-x86_64", "usr/bin/qemu-img", "usr/bin/qemu-nbd",
                       "usr/share/OVMF/OVMF_CODE_4M.fd",
-                      "usr/lib/x86_64-linux-gnu/libvirt/connection-driver/libvirt_driver_qemu.so"),
+                      "usr/lib/x86_64-linux-gnu/libvirt/connection-driver/libvirt_driver_qemu.so",
+                      "usr/share/sci/etc/libvirt/qemu.conf"),
 }
 # Base-owned content in the merged host view; a delta must not re-ship it.
 BASE_OWNED = {
@@ -186,6 +187,29 @@ def test_static_input_contract():
     run("git", "check-ignore", "-q", "--", str(key_path))
 
 
+def test_qemu_vnc_range_carrier():
+    extra = ROOT / "mkosi/mkosi.images/sci-51-virt-qemu/mkosi.extra"
+    rules = [line.strip() for line in
+             (extra / "usr/lib/tmpfiles.d/sci-virt-qemu.conf").read_text().splitlines()]
+    payload = extra / "usr/share/sci/etc/libvirt/qemu.conf"
+    assert payload.is_file(), f"the qemu VNC range payload must exist at {payload}"
+    lines = [line.strip() for line in payload.read_text().splitlines()]
+    assert any(re.fullmatch(r"d\s+/etc/libvirt\s+0755\s+root\s+root\s+-", line) for line in rules), (
+        "the qemu fragment must create /etc/libvirt before the C rule copies into it")
+    assert any(re.fullmatch(
+        r"C\s+/etc/libvirt/qemu\.conf\s+0644\s+root\s+root\s+-\s+/usr/share/sci/etc/libvirt/qemu\.conf",
+        line) for line in rules), (
+        "the qemu fragment must materialize /etc/libvirt/qemu.conf from the /usr payload with type C")
+    assert sum("remote_display_port" in line for line in lines) == 2, (
+        "the payload must declare exactly the two VNC port settings")
+    assert sum(bool(re.fullmatch(r"remote_display_port_min\s*=\s*32200", line)) for line in lines) == 1, (
+        "the payload must set remote_display_port_min = 32200 for the NodePort range")
+    assert sum(bool(re.fullmatch(r"remote_display_port_max\s*=\s*32299", line)) for line in lines) == 1, (
+        "the payload must set remote_display_port_max = 32299 for the NodePort range")
+    assert not [line for line in lines if line.startswith("#") and "remote_display_port" in line], (
+        "the payload must be a partial conffile with no commented-out port settings")
+
+
 @pytest.mark.build
 def test_tools_manifest_pin():
     manifest = STATE / "tools/mkosi.tools.manifest"
 
@@ -6,3 +6,7 @@
 # paths must survive every tmpfiles run.
 d /var/lib/libvirt/qemu 0755 root root -
 d /var/log/libvirt/qemu 0755 root root -
+# libvirt's qemu.conf has no /usr fallback: materialize the VNC port
+# policy at activation. Type C is copy-once, so operator edits survive.
+d /etc/libvirt 0755 root root -
+C /etc/libvirt/qemu.conf 0644 root root - /usr/share/sci/etc/libvirt/qemu.conf
@@ -0,0 +1,5 @@
+# SCI: keep libvirt's automatic VNC ports inside the Kubernetes NodePort
+# range. Materialized by a tmpfiles C rule at activation; the copy is
+# created only when /etc/libvirt/qemu.conf does not exist yet.
+remote_display_port_min = 32200
+remote_display_port_max = 32299