diff --git a/test/image-prepare b/test/image-prepare
index 5a51afc73b..32ec7b7faa 100755
--- a/test/image-prepare
+++ b/test/image-prepare
@@ -127,6 +127,9 @@ def build_install_package(dist_tars: list[str], image: str, *, quick: bool) -> l
         # older OSes don't yet know about watch format v5
         if image in ["debian-trixie"]:
             suppress.add("missing-debian-watch-file-standard")
+            # HACK: Debian trixie does not know about woff-font-in-wrong-dir and you cannot suppress unknown tags.
+            # So instead we suppress the no unknown tags lintian rule.
+            suppress.add("alien-tag")
 
         args.append(fr"""
             cd /var/tmp/build;
diff --git a/tools/debian/cockpit-ws.lintian-overrides b/tools/debian/cockpit-ws.lintian-overrides
index 92b7fbb29d..442434fcca 100644
--- a/tools/debian/cockpit-ws.lintian-overrides
+++ b/tools/debian/cockpit-ws.lintian-overrides
@@ -1,4 +1,5 @@
 cockpit-ws: font-outside-font-dir *usr/share/cockpit/static/fonts/*
+cockpit-ws: woff-font-in-wrong-dir *usr/share/cockpit/static/fonts/*
 cockpit-ws: font-in-non-font-package *usr/share/cockpit/static/fonts/*
 cockpit-ws: package-contains-documentation-outside-usr-share-doc *usr/share/cockpit/*html*
 # the binaries are in /usr/lib/cockpit, but we still want to document them