diff --git a/roles/lmn_vm/tasks/main.yml b/roles/lmn_vm/tasks/main.yml
index 08101fb..b4f7cb8 100644
--- a/roles/lmn_vm/tasks/main.yml
+++ b/roles/lmn_vm/tasks/main.yml
@@ -180,9 +180,13 @@
 
 # FIXME #691138, better: prepare interfaces ready to use, c.f. below
 - name: Allow users to attach to bridge
-  file:
-    path: /usr/lib/qemu/qemu-bridge-helper
-    mode: '4755'
+  ansible.builtin.copy:
+    dest: /etc/apt/apt.conf.d/94qemu-bridge-suid
+    content: |
+      ## Modify permissions after installation/upgrade
+      ## to run qemu-bridge as root
+      DPkg::Post-Invoke {"/usr/bin/chmod 4755 /usr/lib/qemu/qemu-bridge-helper || true"; };
+
 
 - name: Configure macvtap interface
   ansible.builtin.copy: