diff --git a/man/tuned-main.conf.5 b/man/tuned-main.conf.5
index 8d49369..a39b254 100644
--- a/man/tuned-main.conf.5
+++ b/man/tuned-main.conf.5
@@ -70,6 +70,21 @@ will not override user-provided system sysctl settings. If set to \fBFalse\fR or
 \fB0\fR, TuneD sysctl settings will override system sysctl settings. By default
 it's set to \fBTrue\fR.
 
+.TP
+.BI reapply_sysctl_exclude= LIST
+A comma or semicolon separated list of sysctl parameter patterns to exclude
+from reapplication when \fBreapply_sysctl\fR is enabled. This is useful for
+protecting runtime sysctl changes made by Kubernetes CNI plugins or other
+services that set sysctls dynamically. Supports shell-style wildcards
+(\fB*\fR, \fB?\fR, \fB[seq]\fR). By default the list is empty.
+.PP
+.RS
+.B Example:
+.nf
+  reapply_sysctl_exclude = net.ipv4.ip_forward, net.ipv6.conf.*.forwarding
+.fi
+.RE
+
 .TP
 .BI default_instance_priority= INT
 Default instance (unit) priority. By default it's \fB0\fR. Each unit has a
@@ -86,6 +101,7 @@ processed as the first.
   update_interval = 10
   recommend_command = 0
   reapply_sysctl = 1
+  reapply_sysctl_exclude = net.ipv4.ip_forward, net.bridge.bridge-nf-call-iptables
   default_instance_priority = 0
 .fi
 
diff --git a/tuned-main.conf b/tuned-main.conf
index 004511e..b612df4 100644
--- a/tuned-main.conf
+++ b/tuned-main.conf
@@ -28,6 +28,14 @@ recommend_command = 1
 # override user-provided system sysctls.
 reapply_sysctl = 1
 
+# Sysctl parameters matching these patterns will be excluded from
+# reapplication even when reapply_sysctl is enabled. Useful for
+# protecting runtime sysctl changes made by Kubernetes CNI plugins
+# or other services that set sysctls dynamically.
+# Supports shell-style wildcards (*, ?, [seq]). Separated by , or ;
+# Example: net.ipv4.ip_forward, net.ipv6.conf.*.forwarding
+# reapply_sysctl_exclude =
+
 # Default priority assigned to instances
 default_instance_priority = 0
 
diff --git a/tuned/consts.py b/tuned/consts.py
index 233d57e..931a55b 100644
--- a/tuned/consts.py
+++ b/tuned/consts.py
@@ -130,6 +130,7 @@ CFG_SLEEP_INTERVAL = "sleep_interval"
 CFG_UPDATE_INTERVAL = "update_interval"
 CFG_RECOMMEND_COMMAND = "recommend_command"
 CFG_REAPPLY_SYSCTL = "reapply_sysctl"
+CFG_REAPPLY_SYSCTL_EXCLUDE = "reapply_sysctl_exclude"
 CFG_DEFAULT_INSTANCE_PRIORITY = "default_instance_priority"
 CFG_UDEV_BUFFER_SIZE = "udev_buffer_size"
 CFG_LOG_FILE_COUNT = "log_file_count"
@@ -166,6 +167,8 @@ CFG_FUNC_RECOMMEND_COMMAND = "getboolean"
 # reapply system sysctl
 CFG_DEF_REAPPLY_SYSCTL = True
 CFG_FUNC_REAPPLY_SYSCTL = "getboolean"
+# sysctl parameters to exclude from reapplication
+CFG_DEF_REAPPLY_SYSCTL_EXCLUDE = []
 # default instance priority
 CFG_DEF_DEFAULT_INSTANCE_PRIORITY = 0
 CFG_FUNC_DEFAULT_INSTANCE_PRIORITY = "getint"
diff --git a/tuned/plugins/plugin_sysctl.py b/tuned/plugins/plugin_sysctl.py
index 933dcc1..d822989 100644
--- a/tuned/plugins/plugin_sysctl.py
+++ b/tuned/plugins/plugin_sysctl.py
@@ -1,3 +1,4 @@
+import fnmatch
 import re
 from . import base
 from .decorators import *
@@ -100,6 +101,17 @@ class SysctlPlugin(base.Plugin):
 		for option, value in list(instance._sysctl_original.items()):
 			self._write_sysctl(option, value)
 
+	def _is_sysctl_excluded(self, option):
+		"""Check if a sysctl option matches any exclusion pattern."""
+		exclude_list = self._global_cfg.get_list(
+			consts.CFG_REAPPLY_SYSCTL_EXCLUDE,
+			consts.CFG_DEF_REAPPLY_SYSCTL_EXCLUDE
+		)
+		for pattern in exclude_list:
+			if fnmatch.fnmatch(option, pattern):
+				return True
+		return False
+
 	def _apply_system_sysctl(self, instance_sysctl):
 		files = {}
 		for d in SYSCTL_CONFIG_DIRS:
@@ -148,6 +160,11 @@ class SysctlPlugin(base.Plugin):
 					% (path, lineno))
 			return
 		value = value.strip()
+		# Check if this sysctl is excluded from reapplication
+		if self._is_sysctl_excluded(option):
+			log.debug("Skipping excluded sysctl parameter '%s' from '%s'"
+					% (option, path))
+			return
 		if option in instance_sysctl:
 			instance_value = self._variables.expand(instance_sysctl[option])
 			if instance_value != value: