diff --git a/openvmm b/openvmm
index 5ab8a8462..d0bdbed8f 160000
--- a/openvmm
+++ b/openvmm
@@ -1 +1 @@
-Subproject commit 5ab8a84621524f1777b2cb5e65a70dab42c8b453
+Subproject commit d0bdbed8f6e3b86271277dc22658109e2e633b2d
diff --git a/scripts/nvx_tools/ci.py b/scripts/nvx_tools/ci.py
index c354a6cf1..8464c4ca7 100644
--- a/scripts/nvx_tools/ci.py
+++ b/scripts/nvx_tools/ci.py
@@ -405,6 +405,10 @@ def _exact_openvmm_test(test: str) -> str:
 OPENVMM_LINUX_TEST_FILTER = "test(openvmm) | test(ttrpc) | " + " | ".join(
     _exact_openvmm_test(test) for test in OPENVMM_REQUIRED_MICROVM_TESTS
 )
+# A nested test runs inside an L1 VM host whose test function, vm_host or a
+# variant, appears in its name. The Linux runners support neither nested
+# virtualization nor the aarch64-unknown-linux-musl archive of aarch64 hosts.
+OPENVMM_NESTED_TEST_EXCLUSION = " & !test(vm_host)"
 
 
 def _exclude_openvmm_tests(
@@ -425,6 +429,7 @@ def _exclude_openvmm_tests(
 )
 OPENVMM_KVM_TEST_FILTER = _exclude_openvmm_tests(
     f"({OPENVMM_LINUX_TEST_FILTER})"
+    f"{OPENVMM_NESTED_TEST_EXCLUSION}"
     " & !test(no_vmbus_prepped_boot_no_vmbus_windows)"
     " & !test(windows_datacenter_core_2022_x64)"
     " & !test(virtio_net_windows)",
@@ -440,7 +445,8 @@ def _exclude_openvmm_tests(
     "multiarch::pcie::openvmm_linux_x64_pcie_save_restore",
 )
 OPENVMM_MSHV_TEST_FILTER = _exclude_openvmm_tests(
-    f"({OPENVMM_LINUX_TEST_FILTER}) & !test(windows_datacenter_core_2022_x64)",
+    f"({OPENVMM_LINUX_TEST_FILTER}){OPENVMM_NESTED_TEST_EXCLUSION}"
+    " & !test(windows_datacenter_core_2022_x64)",
     OPENVMM_MSHV_EXCLUDED_TESTS,
 )
 # ttrpc::test_ttrpc_interface stays on the Linux backends: it boots Linux
diff --git a/scripts/test_nvx_tools.py b/scripts/test_nvx_tools.py
index 9c621202f..c583f2e1b 100644
--- a/scripts/test_nvx_tools.py
+++ b/scripts/test_nvx_tools.py
@@ -2919,6 +2919,8 @@ def test_openvmm_tests_define_each_backend_filter(self):
                     "test_ttrpc_interface",
                     ci.OPENVMM_TEST_FILTERS[backend],
                 )
+                self.assertIn("!test(vm_host)", ci.OPENVMM_TEST_FILTERS[backend])
+        self.assertNotIn("vm_host", ci.OPENVMM_TEST_FILTERS["whp"])
         self.assertEqual(ci.OPENVMM_WHP_EXCLUDED_TESTS, ())
         self.assertNotIn(
             "multiarch::openvmm_pcat_x64_windows_datacenter_core_2022_x64_boot_heavy",