diff --git a/etc/sysctl.conf b/etc/sysctl.conf
index 0f4c7a6..501f9a8 100644
--- a/etc/sysctl.conf
+++ b/etc/sysctl.conf
@@ -35,6 +35,11 @@ net.ipv4.conf.all.arp_filter = 1
 # disable ipv6
 net.ipv6.conf.all.disable_ipv6 = 1
 
+# but keep ::1 on lo. With ip_nonlocal_bind (below), binding to ::1 succeeds
+# even without the address, so servers trying ::1 before 127.0.0.1 (e.g.
+# Bazel) never fall back and listen where no client can connect.
+net.ipv6.conf.lo.disable_ipv6 = 0
+
 # on user request increase the number of inode watches.
 # 256k should be fine. (default is 8k)
 fs.inotify.max_user_watches = 262144