diff --git a/rust/agama-users/src/model.rs b/rust/agama-users/src/model.rs
index 26b09a5830..93615f6ff4 100644
--- a/rust/agama-users/src/model.rs
+++ b/rust/agama-users/src/model.rs
@@ -232,7 +232,7 @@ impl Model {
     fn open_ssh_port(&self) -> Result<(), service::Error> {
         let firewall_cmd = ChrootCommand::new(self.install_dir.clone())?
             .cmd("firewall-offline-cmd")
-            .args(["-add-service=ssh"])
+            .args(["--add-service=ssh"])
             .output()?;
 
         // ignore error if the firewall is not installed, in that case we do need to open the port,
diff --git a/rust/package/agama.changes b/rust/package/agama.changes
index 8e6e7a32f0..1e1e1a7622 100644
--- a/rust/package/agama.changes
+++ b/rust/package/agama.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Mon Feb 23 15:39:24 UTC 2026 - Imobach Gonzalez Sosa <igonzalezsosa@suse.com>
+
+- Fix firewall-offline-cmd invocation (bsc#1258416).
+
 -------------------------------------------------------------------
 Fri Feb 20 10:20:10 UTC 2026 - Imobach Gonzalez Sosa <igonzalezsosa@suse.com>