diff --git a/docker/neutron/neutron-base/extend_start.sh b/docker/neutron/neutron-base/extend_start.sh
index 6d99826d62..32108209d2 100644
--- a/docker/neutron/neutron-base/extend_start.sh
+++ b/docker/neutron/neutron-base/extend_start.sh
@@ -13,7 +13,8 @@ else
 fi
 
 # set legacy iptables to allow kernels not supporting iptables-nft
-if $UPDATE_ALTERNATIVES --query iptables; then
+# CentOS has update-alternatives 1.13, so use --display (not --query)
+if $UPDATE_ALTERNATIVES --display iptables; then
     # NOTE(yoctozepto): Kolla-Ansible does not always set KOLLA_LEGACY_IPTABLES;
     # the workaround below ensures it gets set to `false` in such cases to fix
     # this code under `set -o nounset`.
diff --git a/releasenotes/notes/bug-1936947-8beac926823cdf8f.yaml b/releasenotes/notes/bug-1936947-8beac926823cdf8f.yaml
new file mode 100644
index 0000000000..75d862acc6
--- /dev/null
+++ b/releasenotes/notes/bug-1936947-8beac926823cdf8f.yaml
@@ -0,0 +1,5 @@
+---
+fixes:
+  - |
+    Fixes wrong update-alternatives usage on CentOS.
+    `LP#1936947 <https://launchpad.net/bugs/1936947>`__