diff --git a/criu/image.c b/criu/image.c
index 3a85eb532..353de48e8 100644
--- a/criu/image.c
+++ b/criu/image.c
@@ -86,6 +86,21 @@ int check_img_inventory(bool restore)
 		goto out_err;
 	}
 
+	if (restore) {
+		if (!he->has_network_lock_method) {
+			/*
+			 * Image files were generated with an older version of CRIU
+			 * so we should fall back to iptables because this is the
+			 * network-lock mechanism used in older versions.
+			 */
+			pr_info("Network lock method not found in inventory image\n");
+			pr_info("Falling back to iptables network lock method\n");
+			opts.network_lock_method = NETWORK_LOCK_IPTABLES;
+		} else {
+			opts.network_lock_method = he->network_lock_method;
+		}
+	}
+
 	ret = 0;
 
 out_err:
@@ -223,6 +238,10 @@ int prepare_inventory(InventoryEntry *he)
 		he->has_tcp_close = true;
 	}
 
+	/* Save network lock method to reuse in restore */
+	he->has_network_lock_method = true;
+	he->network_lock_method = opts.network_lock_method;
+
 	return 0;
 }
 
diff --git a/images/inventory.proto b/images/inventory.proto
index 56e85a80a..a735bad1d 100644
--- a/images/inventory.proto
+++ b/images/inventory.proto
@@ -20,4 +20,5 @@ message inventory_entry {
 	optional uint64			dump_uptime	= 8;
 	optional uint32			pre_dump_mode	= 9;
 	optional bool			tcp_close	= 10;
+	optional uint32			network_lock_method	= 11;
 }
diff --git a/test/zdtm/static/net_lock_socket_iptables.desc b/test/zdtm/static/net_lock_socket_iptables.desc
index 7231886da..1e233132d 100644
--- a/test/zdtm/static/net_lock_socket_iptables.desc
+++ b/test/zdtm/static/net_lock_socket_iptables.desc
@@ -1,5 +1,6 @@
 {
     'flavor': 'h',
     'flags': 'suid excl',
-    'opts': '--tcp-established --network-lock iptables',
+    'dopts': '--tcp-established --network-lock iptables',
+    'ropts': '--tcp-established',
 }
diff --git a/test/zdtm/static/net_lock_socket_iptables6.desc b/test/zdtm/static/net_lock_socket_iptables6.desc
index 7231886da..1e233132d 100644
--- a/test/zdtm/static/net_lock_socket_iptables6.desc
+++ b/test/zdtm/static/net_lock_socket_iptables6.desc
@@ -1,5 +1,6 @@
 {
     'flavor': 'h',
     'flags': 'suid excl',
-    'opts': '--tcp-established --network-lock iptables',
+    'dopts': '--tcp-established --network-lock iptables',
+    'ropts': '--tcp-established',
 }
diff --git a/test/zdtm/static/net_lock_socket_nftables.desc b/test/zdtm/static/net_lock_socket_nftables.desc
index fd8a431ed..d3b82067f 100644
--- a/test/zdtm/static/net_lock_socket_nftables.desc
+++ b/test/zdtm/static/net_lock_socket_nftables.desc
@@ -2,5 +2,6 @@
     'flavor': 'h',
     'flags': 'suid excl',
     'feature': 'network_lock_nftables',
-    'opts': '--tcp-established --network-lock nftables',
+    'dopts': '--tcp-established --network-lock nftables',
+    'ropts': '--tcp-established',
 }
diff --git a/test/zdtm/static/net_lock_socket_nftables6.desc b/test/zdtm/static/net_lock_socket_nftables6.desc
index fd8a431ed..d3b82067f 100644
--- a/test/zdtm/static/net_lock_socket_nftables6.desc
+++ b/test/zdtm/static/net_lock_socket_nftables6.desc
@@ -2,5 +2,6 @@
     'flavor': 'h',
     'flags': 'suid excl',
     'feature': 'network_lock_nftables',
-    'opts': '--tcp-established --network-lock nftables',
+    'dopts': '--tcp-established --network-lock nftables',
+    'ropts': '--tcp-established',
 }
diff --git a/test/zdtm/static/netns_lock_iptables.desc b/test/zdtm/static/netns_lock_iptables.desc
index 08664b53d..52d4177e0 100644
--- a/test/zdtm/static/netns_lock_iptables.desc
+++ b/test/zdtm/static/netns_lock_iptables.desc
@@ -1,6 +1,7 @@
 {
     'flavor': 'h',
     'flags': 'suid excl',
-    'opts': '--tcp-established --network-lock iptables',
+    'opts': '--tcp-established',
+    'dopts': '--network-lock iptables',
     'ropts': '--join-ns net:/var/run/netns/criu-net-lock-test'
 }
diff --git a/test/zdtm/static/netns_lock_nftables.desc b/test/zdtm/static/netns_lock_nftables.desc
index 5e67f45dd..7ed5b3358 100644
--- a/test/zdtm/static/netns_lock_nftables.desc
+++ b/test/zdtm/static/netns_lock_nftables.desc
@@ -2,6 +2,7 @@
     'flavor': 'h',
     'flags': 'suid excl',
     'feature': 'network_lock_nftables',
-    'opts': '--tcp-established --network-lock nftables',
+    'opts': '--tcp-established',
+    'dopts': '--network-lock nftables',
     'ropts': '--join-ns net:/var/run/netns/criu-net-lock-test'
 }