diff --git a/migration/vyos-mode-delta.py b/migration/vyos-mode-delta.py
index faa3b1e..66d06dc 100755
--- a/migration/vyos-mode-delta.py
+++ b/migration/vyos-mode-delta.py
@@ -139,6 +139,23 @@ def build_delta(inv: dict, priority: int, wan_user: str, with_wan: bool,
         "",
     ]
 
+
+    out += [
+        "",
+        "# --- stateful tracking (BOTH boxes) ------------------------",
+        "# VyOS only engages conntrack when a firewall or NAT exists. The",
+        "# backup has no WAN and therefore no NAT, so without this rule it",
+        "# tracks nothing -- and conntrack-sync entries replicated to a box",
+        "# whose conntrack is not engaged cannot be used when it takes over.",
+        "# Verified in labsim: zero conntrack entries until a state-matching",
+        "# rule was present, then replication began immediately.",
+        "set firewall ipv4 forward filter default-action accept",
+        "set firewall ipv4 forward filter rule 10 action accept",
+        "set firewall ipv4 forward filter rule 10 state established",
+        "set firewall ipv4 forward filter rule 10 state related",
+        "set firewall ipv4 forward filter rule 10 description 'stateful tracking'",
+    ]
+
     if with_wan:
         out += [
             "# --- WAN -----------------------------------------------",