diff --git a/Makefile b/Makefile
index 69e6a5de5..0a4fad2f2 100644
--- a/Makefile
+++ b/Makefile
@@ -33,5 +33,7 @@ test-unit:
 
 # Privileged suite: runs the `privileged`-tagged tests inside a --privileged
 # --cap-add=NET_ADMIN container via the ory/dockertest harness. Requires Docker.
+# Narrow the run with env vars, e.g.:
+#   PRIV_RUN=TestNftablesManager PRIV_PKGS=./client/firewall/nftables/... make test-privileged
 test-privileged:
 	@go test -tags 'devcert privileged' -timeout 30m -run TestRunPrivilegedSuiteInDocker -v ./client/testutil/privileged/...
diff --git a/client/testutil/privileged/runner_test.go b/client/testutil/privileged/runner_test.go
index cd226b5b4..d0b449866 100644
--- a/client/testutil/privileged/runner_test.go
+++ b/client/testutil/privileged/runner_test.go
@@ -99,12 +99,7 @@ func TestRunPrivilegedSuiteInDocker(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Minute)
 	defer cancel()
 
-	script := fmt.Sprintf(
-		"apk update >/dev/null && apk add --no-cache %s >/dev/null && %s | xargs go test -buildvcs=false -tags 'devcert privileged' -v -timeout 20m -p 1",
-		alpinePackages, privilegedTestPackages,
-	)
-
-	result, err := resource.Exec(ctx, []string{"sh", "-c", script})
+	result, err := resource.Exec(ctx, []string{"sh", "-c", buildTestScript()})
 	if err != nil {
 		t.Fatalf("run privileged suite in container: %v", err)
 	}
@@ -153,3 +148,23 @@ func goEnv(t *testing.T, key string) string {
 	}
 	return strings.TrimSpace(out.String())
 }
+
+// buildTestScript builds the in-container command. PRIV_PKGS overrides the package
+// list (default: the full filtered set); PRIV_RUN adds a -run test-name filter.
+// Both empty reproduces the full privileged suite.
+func buildTestScript() string {
+	pkgs := privilegedTestPackages + " | xargs"
+	if p := os.Getenv("PRIV_PKGS"); p != "" {
+		pkgs = "echo " + p + " | xargs"
+	}
+
+	runFilter := ""
+	if r := os.Getenv("PRIV_RUN"); r != "" {
+		runFilter = "-run '" + r + "' "
+	}
+
+	return fmt.Sprintf(
+		"apk update >/dev/null && apk add --no-cache %s >/dev/null && %s go test -buildvcs=false -tags 'devcert privileged' %s-v -timeout 20m -p 1",
+		alpinePackages, pkgs, runFilter,
+	)
+}
diff --git a/docs/testing-privileged.md b/docs/testing-privileged.md
index df17ae82e..cf2f23171 100644
--- a/docs/testing-privileged.md
+++ b/docs/testing-privileged.md
@@ -19,8 +19,14 @@ go test -tags devcert ./...
 # Privileged suite: runs the privileged-tagged tests inside a
 # --privileged --cap-add=NET_ADMIN container (requires Docker).
 make test-privileged
+
+# Narrow the container run to a single test / package:
+PRIV_RUN=TestNftablesManager PRIV_PKGS=./client/firewall/nftables/... make test-privileged
 ```
 
+`PRIV_RUN` adds a `-run` test-name filter and `PRIV_PKGS` overrides the package
+list; both are optional and default to the full privileged suite.
+
 `make test-privileged` invokes the `ory/dockertest` harness in
 `client/testutil/privileged/`. The harness: