diff --git a/internal/firewall/firewall_ipv6_test.go b/internal/firewall/firewall_ipv6_test.go
index dc5141f..37e9f0d 100644
--- a/internal/firewall/firewall_ipv6_test.go
+++ b/internal/firewall/firewall_ipv6_test.go
@@ -163,8 +163,21 @@ func TestTemplate_nftSyntax(t *testing.T) {
 		t.Fatal(err)
 	}
 	f.Close()
-	cmd := exec.Command(nft, "-c", "-f", f.Name())
-	if combined, err := cmd.CombinedOutput(); err != nil {
+	// `nft -c` liest die Kernel-Ruleset-Cache via netlink → braucht root.
+	// Als nicht-root via sudo -n versuchen; klappt das nicht, skip statt fail
+	// (auf den Nodes rendert/prüft edgeguard ohnehin als root).
+	var cmd *exec.Cmd
+	if os.Geteuid() == 0 {
+		cmd = exec.Command(nft, "-c", "-f", f.Name())
+	} else {
+		cmd = exec.Command("sudo", "-n", nft, "-c", "-f", f.Name())
+	}
+	combined, err := cmd.CombinedOutput()
+	if err != nil {
+		msg := string(combined)
+		if strings.Contains(msg, "Operation not permitted") || strings.Contains(msg, "a password is required") || strings.Contains(msg, "may not run sudo") {
+			t.Skipf("nft -c needs root (no usable sudo): %s", strings.TrimSpace(msg))
+		}
 		t.Fatalf("nft -c -f rejected the generated ruleset: %v\n%s\n----\n%s", err, combined, out)
 	}
 }