diff --git a/src/docker-in-docker/install.sh b/src/docker-in-docker/install.sh
index 5af320b0b..a66296e03 100755
--- a/src/docker-in-docker/install.sh
+++ b/src/docker-in-docker/install.sh
@@ -312,8 +312,15 @@ fi
 
 # Swap to legacy iptables for compatibility (Debian only)
 if [ "${ADJUSTED_ID}" = "debian" ] && type iptables-legacy > /dev/null 2>&1; then
-    update-alternatives --set iptables /usr/sbin/iptables-legacy
-    update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
+    # Check if host kernel supports ip_tables/iptable_nat
+    if iptables-legacy -t nat -L > /dev/null 2>&1; then
+        update-alternatives --set iptables /usr/sbin/iptables-legacy
+        update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
+    else
+        # first appeared in Ubuntu ≥ 26.04
+        update-alternatives --set iptables  /usr/sbin/iptables-nft
+        update-alternatives --set ip6tables /usr/sbin/ip6tables-nft
+    fi
 fi
 
 # Set up the necessary repositories