diff --git a/docs/lab/prod/ferrix.textpb b/docs/lab/prod/ferrix.textpb
index f2593d3..480d9aa 100644
--- a/docs/lab/prod/ferrix.textpb
+++ b/docs/lab/prod/ferrix.textpb
@@ -5,7 +5,9 @@ local_asn: 4200000001            # private; stripped by the production router
 
 # IPv6 prefixes are only announced over an IPv6 session, and the next hop is
 # our end of it, so listen and dial on the tunnel's IPv6 address.
-listen_endpoints { address: "2a0d:d747:1::" port: 179 }
+# Port 179 on a specific address needs root on macOS. The listener is unused
+# here anyway: the router is passive and we dial out to its port 179.
+listen_endpoints { address: "2a0d:d747:1::" port: 9179 }
 
 peers {
     name: "prod"