diff --git a/internal/nftables/manager.go b/internal/nftables/manager.go
index 249eed4..9f78107 100644
--- a/internal/nftables/manager.go
+++ b/internal/nftables/manager.go
@@ -96,7 +96,8 @@ func (m *Manager) Generate(haproxyPorts []int, extraTCPPorts []int, extraUDPPort
 	sb.WriteString("    }\n\n")
 
 	sb.WriteString("    chain input {\n")
-	sb.WriteString("        type filter hook input priority filter; policy accept;\n\n")
+	sb.WriteString("        # Priority -1 so loopback accept runs before CrowdSec's blacklist chain (priority 0)\n")
+	sb.WriteString("        type filter hook input priority -1; policy accept;\n\n")
 	sb.WriteString("        iif \"lo\" accept\n")
 	sb.WriteString("        ct state { established, related } accept\n")
 
@@ -180,6 +181,8 @@ func (m *Manager) SafeApply(content string) error {
 		return fmt.Errorf("verification failed (rolled back): %w", err)
 	}
 
+	os.Remove(m.rulesPath + ".bak")
+
 	return nil
 }
 
diff --git a/internal/nftables/manager_test.go b/internal/nftables/manager_test.go
index 00bab70..b2a9e4e 100644
--- a/internal/nftables/manager_test.go
+++ b/internal/nftables/manager_test.go
@@ -43,7 +43,7 @@ func TestGenerate_AlwaysIncludesStructure(t *testing.T) {
 		"table inet wild-central",
 		"set allowed_tcp_ports",
 		"chain input",
-		"type filter hook input priority filter; policy accept;",
+		"type filter hook input priority -1; policy accept;",
 		"iif \"lo\" accept",
 		"ct state { established, related } accept",
 	} {