diff --git a/nixos/reisen-ct/network.nix b/nixos/reisen-ct/network.nix
index 0f444edc..7f70a392 100644
--- a/nixos/reisen-ct/network.nix
+++ b/nixos/reisen-ct/network.nix
@@ -24,4 +24,9 @@ in {
     linkConfig.Multicast = true;
     networkConfig.MulticastDNS = true;
   };
+
+  boot.kernel.sysctl = {
+    # not sure how to get it to overlap with subgid/idmap...
+    "net.ipv4.ping_group_range" = "0 7999";
+  };
 }