diff --git a/roles/svc-storage-nfs-server/vars/main.yml b/roles/svc-storage-nfs-server/vars/main.yml
index 48b66a5f26..d3494e35a4 100644
--- a/roles/svc-storage-nfs-server/vars/main.yml
+++ b/roles/svc-storage-nfs-server/vars/main.yml
@@ -13,7 +13,7 @@ SVC_STORAGE_NFS_SERVER_SERVICE:
     Archlinux: nfs-ganesha
 
 SVC_STORAGE_NFS_SERVER_STATE_EXPORT_OPTIONS: >-
-  rw,sync,no_subtree_check,no_root_squash,no_all_squash
+  rw,sync,insecure,no_subtree_check,no_root_squash,no_all_squash
 SVC_STORAGE_NFS_SERVER_STATE_ALLOWED_CIDRS:
   - "*"
 
diff --git a/tests/unit/python/plugins/lookup/test_nfs_lookups.py b/tests/unit/python/plugins/lookup/test_nfs_lookups.py
index 835eba5152..ad70d95efa 100644
--- a/tests/unit/python/plugins/lookup/test_nfs_lookups.py
+++ b/tests/unit/python/plugins/lookup/test_nfs_lookups.py
@@ -35,19 +35,19 @@ class TestNfsLookups(unittest.TestCase):
     def test_mount_opts_github_soft(self):
         self.assertEqual(
             _run("nfs_mount_opts", BASE),
-            "vers=4,rw,soft,timeo=50,retrans=3",
+            "vers=4,rw,noresvport,soft,timeo=50,retrans=3",
         )
 
     def test_mount_opts_host_hard(self):
         self.assertEqual(
             _run("nfs_mount_opts", {**BASE, "RUNTIME": "host"}),
-            "vers=4,rw,hard,timeo=600",
+            "vers=4,rw,noresvport,hard,timeo=600",
         )
 
     def test_mount_opts_act_soft(self):
         self.assertEqual(
             _run("nfs_mount_opts", {**BASE, "RUNTIME": "act"}),
-            "vers=4,rw,soft,timeo=50,retrans=3",
+            "vers=4,rw,noresvport,soft,timeo=50,retrans=3",
         )
 
 
diff --git a/tests/unit/python/utils/storage/test_nfs.py b/tests/unit/python/utils/storage/test_nfs.py
index 5ab4bd3b7c..10b7e9609f 100644
--- a/tests/unit/python/utils/storage/test_nfs.py
+++ b/tests/unit/python/utils/storage/test_nfs.py
@@ -22,17 +22,28 @@ class TestNfsHelpers(unittest.TestCase):
 
     def test_mount_opts_lab_runtimes_soft(self):
         for rt in ("dev", "act", "github"):
-            self.assertEqual(mount_opts(4, rt), "vers=4,rw,soft,timeo=50,retrans=3")
+            self.assertEqual(
+                mount_opts(4, rt), "vers=4,rw,noresvport,soft,timeo=50,retrans=3"
+            )
 
     def test_mount_opts_prod_hard(self):
-        self.assertEqual(mount_opts(4, "host"), "vers=4,rw,hard,timeo=600")
+        self.assertEqual(mount_opts(4, "host"), "vers=4,rw,noresvport,hard,timeo=600")
+
+    def test_mount_opts_keep_the_client_off_published_privileged_ports(self):
+        """A reserved source port can land on imaps/993 or pop3s/995 and then
+        blocks the whole ingress port set of the mail stack."""
+        for version in (3, 4):
+            for runtime in ("dev", "act", "github", "host"):
+                self.assertIn("noresvport", mount_opts(version, runtime))
 
     def test_mount_opts_v4_carries_no_v3_locking_token(self):
         self.assertNotIn("local_lock", mount_opts(4, "host"))
         self.assertNotIn("nolock", mount_opts(4, "host"))
 
     def test_mount_opts_v3_still_disables_nlm(self):
-        self.assertEqual(mount_opts(3, "host"), "vers=3,rw,hard,timeo=600,nolock")
+        self.assertEqual(
+            mount_opts(3, "host"), "vers=3,rw,noresvport,hard,timeo=600,nolock"
+        )
 
     def test_client_src_kernel_v4_is_root(self):
         self.assertEqual(
diff --git a/utils/storage/nfs.py b/utils/storage/nfs.py
index b483e6b21b..f9537aa724 100644
--- a/utils/storage/nfs.py
+++ b/utils/storage/nfs.py
@@ -61,7 +61,7 @@ def mount_opts(version, runtime):
         else "hard,timeo=600"
     )
     locking = "" if int(version) >= 4 else ",nolock"
-    return f"vers={version},rw,{reliability}{locking}"
+    return f"vers={version},rw,noresvport,{reliability}{locking}"
 
 
 def client_src(server, version, flavor, state_path_value):