diff --git a/pkg/registry/core/service/portallocator/controller/repair.go b/pkg/registry/core/service/portallocator/controller/repair.go
--- a/pkg/registry/core/service/portallocator/controller/repair.go	(revision f66044f4361b9f1f96f0053dd46cb7dce5e990a8)
+++ b/pkg/registry/core/service/portallocator/controller/repair.go	(revision bdd789d982712179c6a849ceed7f12e063b3fce3)
@@ -21,6 +21,8 @@
 	"fmt"
 	"time"

+	"source.monogon.dev/metropolis/node"
+
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -123,6 +126,18 @@
 		return fmt.Errorf("unable to refresh the port block: %v", err)
 	}

+	// pretend that metropolis system ports are in use by an actual service
+	var metropolisService corev1.Service
+	for _, p := range node.SystemPorts {
+		metropolisService.Spec.Ports = append(metropolisService.Spec.Ports, corev1.ServicePort{
+			Name:     p.String(),
+			Protocol: corev1.ProtocolTCP,
+			Port:     int32(p),
+			NodePort: int32(p),
+		})
+	}
+	list.Items = append(list.Items, metropolisService)
+
 	rebuilt, err := portallocator.NewInMemory(c.portRange)
 	if err != nil {
 		return fmt.Errorf("unable to create port allocator: %v", err)