diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0751cf900..8447ccf41 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -335,6 +335,19 @@ jobs:
           name: packages-fedora-43
           path: target/packages/
 
+      - name: Ensure libvirt default network is active
+        run: |
+          set -euxo pipefail
+          virsh net-list --all
+          if virsh net-info default >/dev/null 2>&1; then
+            if ! virsh net-start default; then
+              echo "Note: virsh net-start default returned non-zero (network may already be active)"
+            fi
+            virsh net-autostart default || echo "Note: virsh net-autostart default returned non-zero"
+          fi
+          virsh net-list --all
+          virsh net-dhcp-leases default || echo "Note: no DHCP leases yet for default network"
+
       - name: Build container and test on CoreOS
         run: |
           BOOTC_SKIP_PACKAGE=1 just build
diff --git a/crates/xtask/src/tmt.rs b/crates/xtask/src/tmt.rs
index 2fc9b9db8..2902114c4 100644
--- a/crates/xtask/src/tmt.rs
+++ b/crates/xtask/src/tmt.rs
@@ -199,6 +199,19 @@ fn wait_for_vm_ready(sh: &Shell, vm_name: &str) -> Result<(u16, String)> {
     )
 }
 
+/// Dump libvirt diagnostics for a VM to aid debugging when SSH connectivity fails.
+/// Prints virsh information to stderr; all commands are best-effort (errors are ignored).
+fn dump_libvirt_diagnostics(sh: &Shell, vm_name: &str) {
+    eprintln!("=== libvirt diagnostics ===");
+    let _ = cmd!(sh, "virsh list --all").ignore_status().run();
+    let _ = cmd!(sh, "virsh net-list --all").ignore_status().run();
+    let _ = cmd!(sh, "virsh net-dhcp-leases default").ignore_status().run();
+    let _ = cmd!(sh, "virsh dominfo {vm_name}").ignore_status().run();
+    let _ = cmd!(sh, "virsh domiflist {vm_name}").ignore_status().run();
+    let _ = cmd!(sh, "virsh dumpxml {vm_name}").ignore_status().run();
+    eprintln!("=== end libvirt diagnostics ===");
+}
+
 /// Verify SSH connectivity to the VM
 /// Uses a more complex command similar to what TMT runs to ensure full readiness
 #[context("Verifying SSH connectivity")]
@@ -597,6 +610,7 @@ pub(crate) fn run_tmt(sh: &Shell, args: &RunTmtArgs) -> Result<()> {
         println!("Verifying SSH connectivity...");
         if let Err(e) = verify_ssh_connectivity(sh, ssh_port, &key_path) {
             eprintln!("SSH verification failed for plan {}: {:#}", plan, e);
+            dump_libvirt_diagnostics(sh, &vm_name);
             cleanup_vm();
             all_passed = false;
             test_results.push((plan.to_string(), false, None));