diff --git a/scripts/harden-jumphost.sh b/scripts/harden-jumphost.sh
index 9a75a9c..6fc32b4 100644
--- a/scripts/harden-jumphost.sh
+++ b/scripts/harden-jumphost.sh
@@ -307,11 +307,16 @@ EOF
 # hook that just (re)inserts the jump at every boot.
 : "${ENABLE_FIREWALL:=1}"
 if [[ "$ENABLE_FIREWALL" == "1" && -f "$SCRIPT_DIR/harden-firewall.sh" ]]; then
-    log "Installing host firewall (deny-by-default INPUT; carries the sshguard jump)..."
+    log "Installing host firewall (deny-by-default; iptables or firewalld per OS)..."
     SSH_PORT="$SSH_PORT" OPEN_PORTS="${OPEN_PORTS:-}" \
     FW_SSH_SOURCE="${FW_SSH_SOURCE:-}" FW_ALLOW_PING="${FW_ALLOW_PING:-1}" \
     FORCE=1 bash "$SCRIPT_DIR/harden-firewall.sh" apply \
-        || warn "harden-firewall.sh failed; INPUT left unfiltered. Re-run it manually."
+        || warn "harden-firewall.sh failed; host firewall not applied. Re-run it manually."
+elif [[ "$OS_FAMILY" == rhel ]]; then
+    # On Alma/RHEL sshguard uses its firewalld backend (sshg-fw-firewalld) and
+    # manages its own firewalld ipset blocks -- there is no iptables INPUT->sshguard
+    # jump to add, so skip the boot hook.
+    warn "Host firewall disabled; sshguard manages firewalld directly (no iptables jump)."
 else
     HOOK=$(mktemp)
     cat > "$HOOK" <<'EOF'
diff --git a/scripts/harden-ssh.sh b/scripts/harden-ssh.sh
index 20fe080..e563a00 100644
--- a/scripts/harden-ssh.sh
+++ b/scripts/harden-ssh.sh
@@ -286,11 +286,16 @@ EOF
 # hook that just (re)inserts the jump at every boot.
 : "${ENABLE_FIREWALL:=1}"
 if [[ "$ENABLE_FIREWALL" == "1" && -f "$SCRIPT_DIR/harden-firewall.sh" ]]; then
-    log "Installing host firewall (deny-by-default INPUT; carries the sshguard jump)..."
+    log "Installing host firewall (deny-by-default; iptables or firewalld per OS)..."
     SSH_PORT="$SSH_PORT" OPEN_PORTS="${OPEN_PORTS:-}" \
     FW_SSH_SOURCE="${FW_SSH_SOURCE:-}" FW_ALLOW_PING="${FW_ALLOW_PING:-1}" \
     FORCE=1 bash "$SCRIPT_DIR/harden-firewall.sh" apply \
-        || warn "harden-firewall.sh failed; INPUT left unfiltered. Re-run it manually."
+        || warn "harden-firewall.sh failed; host firewall not applied. Re-run it manually."
+elif [[ "$OS_FAMILY" == rhel ]]; then
+    # On Alma/RHEL sshguard uses its firewalld backend (sshg-fw-firewalld) and
+    # manages its own firewalld ipset blocks -- there is no iptables INPUT->sshguard
+    # jump to add, so skip the boot hook.
+    warn "Host firewall disabled; sshguard manages firewalld directly (no iptables jump)."
 else
     HOOK=$(mktemp)
     cat > "$HOOK" <<'EOF'