diff --git a/images/fedora-remote/files/grd-firstboot b/images/fedora-remote/files/grd-firstboot
index 349ea54..d6d6463 100755
--- a/images/fedora-remote/files/grd-firstboot
+++ b/images/fedora-remote/files/grd-firstboot
@@ -35,4 +35,10 @@ fi
 grdctl --system rdp enable
 systemctl restart gnome-remote-desktop.service || true
 
+# Open the RDP port in firewalld (best effort; firewalld may not be installed).
+if command -v firewall-cmd >/dev/null 2>&1; then
+  firewall-cmd --permanent --add-service=rdp >/dev/null 2>&1 || true
+  firewall-cmd --reload >/dev/null 2>&1 || true
+fi
+
 touch "${MARKER}"