diff --git a/contrib/ay-openqa-worker-leap-3-nvme.xml b/contrib/ay-openqa-worker-leap-3-nvme.xml
index f6b955c9cdc..f7320500b34 100644
--- a/contrib/ay-openqa-worker-leap-3-nvme.xml
+++ b/contrib/ay-openqa-worker-leap-3-nvme.xml
@@ -139,7 +139,15 @@
   <firewall>
     <enable_firewall t="boolean">true</enable_firewall>
     <start_firewall t="boolean">true</start_firewall>
-    <FW_CONFIGURATIONS_EXT>sshd</FW_CONFIGURATIONS_EXT>
+    <default_zone>public</default_zone>
+    <zones config:type="list">
+      <zone>
+	<name>public</name>
+	<services config:type="list">
+          <service>ssh</service>
+	</services>
+      </zone>
+    </zones>
   </firewall>
   <services-manager>
     <services>
diff --git a/contrib/ay-openqa-worker.xml.erb b/contrib/ay-openqa-worker.xml.erb
index 38207648a89..29bfe6434ca 100644
--- a/contrib/ay-openqa-worker.xml.erb
+++ b/contrib/ay-openqa-worker.xml.erb
@@ -98,7 +98,15 @@
   <firewall>
     <enable_firewall config:type="boolean">true</enable_firewall>
     <start_firewall config:type="boolean">true</start_firewall>
-    <FW_CONFIGURATIONS_EXT>sshd</FW_CONFIGURATIONS_EXT>
+    <default_zone>public</default_zone>
+    <zones config:type="list">
+      <zone>
+	<name>public</name>
+	<services config:type="list">
+          <service>ssh</service>
+	</services>
+      </zone>
+    </zones>
   </firewall>
   <services-manager t="map">
     <services>