diff --git a/meson.build b/meson.build
index 69561f13..29a727c0 100644
--- a/meson.build
+++ b/meson.build
@@ -41,15 +41,9 @@ endif
 gperf    = find_program('gperf', required: false)
 protoc_c = find_program('protoc-c', required: false)
 ipcalc   = find_program(['ipcalc', 'ipcalc-ng'], required: true)
-nft_prog = find_program('nft', required: false)
-
 # Firewall script selection
 _fw_opt = get_option('firewall-script')
-if _fw_opt == 'auto'
-  fw_script_type = nft_prog.found() ? 'nftables' : 'iptables'
-else
-  fw_script_type = _fw_opt
-endif
+fw_script_type = (_fw_opt == 'auto') ? 'nftables' : _fw_opt
 message('firewall script: ' + fw_script_type)
 
 # --------------------------------------------------------------------------
diff --git a/meson_options.txt b/meson_options.txt
index f6caea96..b1425de3 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -26,4 +26,4 @@ option('tun-tests',         type: 'boolean',  value: true,      description: 'En
 option('kerberos-tests',    type: 'boolean',  value: false,     description: 'Enable tests requiring a Kerberos setup')
 option('with-werror',       type: 'boolean',  value: false,     description: 'Treat compiler warnings as errors')
 option('pager',             type: 'string',   value: 'less',    description: 'Default pager for occtl (empty string for none)')
-option('firewall-script',   type: 'combo',    choices: ['auto', 'nftables', 'iptables'], value: 'auto', description: 'Firewall script backend (auto prefers nftables if nft is found)')
+option('firewall-script',   type: 'combo',    choices: ['auto', 'nftables', 'iptables'], value: 'nftables', description: 'Firewall script backend (nftables by default; auto is an alias for nftables)')