diff --git a/cmd/spindle-microvm-run/main_linux.go b/cmd/spindle-microvm-run/main_linux.go
index 2d37fff7..645d94b7 100644
--- a/cmd/spindle-microvm-run/main_linux.go
+++ b/cmd/spindle-microvm-run/main_linux.go
@@ -137,7 +137,7 @@ func runMicroVMRunDev(ctx context.Context, cmd *cli.Command) error {
 	if mib := cmd.Uint("memory-mib"); mib > 0 {
 		imageSpec.MemoryMiB = int(mib)
 	}
-	ln, err := vsock.Listen(port, nil)
+	ln, err := vsock.ListenContextID(vsock.Host, port, nil)
 	if err != nil {
 		return fmt.Errorf("listen on vsock port %d: %w", port, err)
 	}
diff --git a/spindle/engines/microvm/agent.go b/spindle/engines/microvm/agent.go
index 9204b5b2..ed757810 100644
--- a/spindle/engines/microvm/agent.go
+++ b/spindle/engines/microvm/agent.go
@@ -28,7 +28,10 @@ type agentHub struct {
 }
 
 func newAgentHub(port uint32, l *slog.Logger) (*agentHub, error) {
-	ln, err := vsock.Listen(port, nil)
+	// bind the host context explicitly. if the local CID resolves to the
+	// loopback CID (which happens on some systems when vsock_loopback is active),
+	// Listen() would bind loopback and never see guest VMs
+	ln, err := vsock.ListenContextID(vsock.Host, port, nil)
 	if err != nil {
 		return nil, fmt.Errorf("listen for agent on vsock port %d: %w", port, err)
 	}
diff --git a/spindle/engines/microvm/read_cache_proxy.go b/spindle/engines/microvm/read_cache_proxy.go
index 65d838c5..83b01cf2 100644
--- a/spindle/engines/microvm/read_cache_proxy.go
+++ b/spindle/engines/microvm/read_cache_proxy.go
@@ -195,7 +195,7 @@ func listenRandomVsockPort(ctx context.Context) (*vsock.Listener, uint32, error)
 		if err != nil {
 			return nil, 0, err
 		}
-		ln, err := vsock.Listen(port, nil)
+		ln, err := vsock.ListenContextID(vsock.Host, port, nil)
 		if err == nil {
 			return ln, port, nil
 		}
diff --git a/spindle/engines/microvm/upload_cache_proxy.go b/spindle/engines/microvm/upload_cache_proxy.go
index 9b9385d2..cc87062f 100644
--- a/spindle/engines/microvm/upload_cache_proxy.go
+++ b/spindle/engines/microvm/upload_cache_proxy.go
@@ -142,7 +142,7 @@ func listenRandomVsockUploadPort(ctx context.Context) (*vsock.Listener, uint32,
 		if err != nil {
 			return nil, 0, err
 		}
-		ln, err := vsock.Listen(port, nil)
+		ln, err := vsock.ListenContextID(vsock.Host, port, nil)
 		if err == nil {
 			return ln, port, nil
 		}