diff --git a/src/basic/socket-util.c b/src/basic/socket-util.c
index 159486f7f1..eab09786b6 100644
--- a/src/basic/socket-util.c
+++ b/src/basic/socket-util.c
@@ -1794,7 +1794,7 @@ int vsock_get_local_cid(unsigned *ret) {
         /* If ret == NULL, we're just want to check if AF_VSOCK is available, so accept
          * any address. Otherwise, filter out special addresses that are cannot be used
          * to identify _this_ machine from the outside. */
-        if (ret && IN_SET(tmp, VMADDR_CID_LOCAL, VMADDR_CID_HOST))
+        if (ret && IN_SET(tmp, VMADDR_CID_LOCAL, VMADDR_CID_HOST, VMADDR_CID_ANY))
                 return log_debug_errno(SYNTHETIC_ERRNO(EADDRNOTAVAIL),
                                        "IOCTL_VM_SOCKETS_GET_LOCAL_CID returned special value (%u), ignoring.", tmp);
 
diff --git a/src/ssh-generator/ssh-proxy.c b/src/ssh-generator/ssh-proxy.c
index 337153787e..bfb91b5867 100644
--- a/src/ssh-generator/ssh-proxy.c
+++ b/src/ssh-generator/ssh-proxy.c
@@ -62,6 +62,9 @@ static int process_vsock_string(const char *host, const char *port) {
         if (r < 0)
                 return log_error_errno(r, "Failed to parse vsock cid: %s", host);
 
+        if (cid == VMADDR_CID_ANY)
+                return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot use VMADDR_CID_ANY to connect to a remote host.");
+
         return process_vsock_cid(cid, port);
 }