diff --git a/pkg/registry/core/service/portallocator/allocator.go b/pkg/registry/core/service/portallocator/allocator.go
--- a/pkg/registry/core/service/portallocator/allocator.go	(revision f66044f4361b9f1f96f0053dd46cb7dce5e990a8)
+++ b/pkg/registry/core/service/portallocator/allocator.go	(revision bdd789d982712179c6a849ceed7f12e063b3fce3)
@@ -25,6 +25,7 @@
 	"k8s.io/kubernetes/pkg/registry/core/service/allocator"

 	"k8s.io/klog/v2"
+	"source.monogon.dev/metropolis/node"
 )

 // Interface manages the allocation of ports out of a range. Interface
@@ -70,6 +71,12 @@
 	}
 	var err error
 	a.alloc, err = allocatorFactory(max, rangeSpec)
+
+	for _, p := range node.SystemPorts {
+		// We ignore errors as these could only happen if the port we try to
+		// allocate is out of range, which we dont really care about.
+		_, _ = a.alloc.Allocate(int(p))
+	}
 	return a, err
 }

diff --git a/pkg/registry/core/service/portallocator/controller/repair.go b/pkg/registry/core/service/portallocator/controller/repair.go
--- a/pkg/registry/core/service/portallocator/controller/repair.go	(revision f66044f4361b9f1f96f0053dd46cb7dce5e990a8)
+++ b/pkg/registry/core/service/portallocator/controller/repair.go	(revision bdd789d982712179c6a849ceed7f12e063b3fce3)
@@ -21,6 +21,8 @@
 	"fmt"
 	"time"

+	"source.monogon.dev/metropolis/node"
+
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -123,6 +126,18 @@
 		return fmt.Errorf("unable to refresh the port block: %v", err)
 	}

+	// pretend that metropolis system ports are in use by an actual service
+	var metropolisService corev1.Service
+	for _, p := range node.SystemPorts {
+		metropolisService.Spec.Ports = append(metropolisService.Spec.Ports, corev1.ServicePort{
+			Name:     p.String(),
+			Protocol: corev1.ProtocolTCP,
+			Port:     int32(p),
+			NodePort: int32(p),
+		})
+	}
+	list.Items = append(list.Items, metropolisService)
+
 	rebuilt, err := portallocator.NewInMemory(c.portRange)
 	if err != nil {
 		return fmt.Errorf("unable to create port allocator: %v", err)