diff --git a/Makefile b/Makefile
index 10333663..3ecc4c10 100644
--- a/Makefile
+++ b/Makefile
@@ -152,10 +152,9 @@ testIntegration: | build deps
 
 DOCKER := $(or $(shell which podman 2>/dev/null), $(shell which docker 2>/dev/null))
 
-# NAT real-topology scenarios (podman-compose), all sharing one image built
-# here. Runs every scenario; run one with
-# `make testNatIntegration STORAGE_INTEGRATION_TEST_INCLUDES=<scenario>` (the
-# scenario's folder name, e.g. reachable).
+# NAT real-topology scenarios (podman-compose), all sharing one image built here.
+# Runs every scenario; limit it with STORAGE_INTEGRATION_TEST_INCLUDES (test file
+# paths), as testIntegration does.
 buildNatImage:
 	$(DOCKER) build -t localhost/storage-nat -f tests/integration/nat/Dockerfile .
 
diff --git a/tests/imports.nim b/tests/imports.nim
index da22f3c1..19ab608a 100644
--- a/tests/imports.nim
+++ b/tests/imports.nim
@@ -2,12 +2,9 @@ import std/macros
 import std/os
 import std/strutils
 
-macro importTests*(
-    dir: static string, exclude: static string, only: static string
-): untyped =
+macro importTests*(dir: static string, exclude: static string): untyped =
   ## imports every test*.nim file under `dir` (recursively).
-  ## `exclude` (when non-empty) skips files whose path contains it.
-  ## `only` (when non-empty) keeps only files whose path contains it.
+  ## `exclude`, when non-empty, skips files whose path contains it.
   let imports = newStmtList()
   for file in walkDirRec(dir):
     let (_, name, ext) = splitFile(file)
@@ -15,8 +12,6 @@ macro importTests*(
       continue
     if exclude.len > 0 and exclude in file:
       continue
-    if only.len > 0 and only notin file:
-      continue
     imports.add(
       quote do:
         import `file`
diff --git a/tests/integration/nat/not-reachable/README.md b/tests/integration/nat/not-reachable/README.md
index 17762bb0..32d9e008 100644
--- a/tests/integration/nat/not-reachable/README.md
+++ b/tests/integration/nat/not-reachable/README.md
@@ -26,14 +26,23 @@ range never leaks to host routes.
 
 ## Run
 
+Every NAT scenario:
+
 ```bash
-make testNatIntegration STORAGE_INTEGRATION_TEST_INCLUDES=not-reachable
+make testNatIntegration
 ```
 
-Runs this scenario (omit the var to run every NAT scenario). Builds the shared
-image and runs `testnotreachable.nim`, which brings the compose topology up and
-down. Rootless, but needs the host netfilter modules — if the router fails on
-iptables: `sudo modprobe iptable_nat nf_conntrack`.
+Just this one — same `STORAGE_INTEGRATION_TEST_INCLUDES` filter as testIntegration,
+with the test file path:
+
+```bash
+make testNatIntegration \
+  STORAGE_INTEGRATION_TEST_INCLUDES=tests/integration/nat/not-reachable/testnotreachable.nim
+```
+
+Builds the shared image and brings the compose topology up and down. Rootless, but
+needs the host netfilter modules — if the router fails on iptables:
+`sudo modprobe iptable_nat nf_conntrack`.
 
 ## Expected result
 
diff --git a/tests/integration/nat/reachable/README.md b/tests/integration/nat/reachable/README.md
index 5289eed0..199a55b5 100644
--- a/tests/integration/nat/reachable/README.md
+++ b/tests/integration/nat/reachable/README.md
@@ -25,14 +25,23 @@ The wan public range and `internal` flag work as in
 
 ## Run
 
+Every NAT scenario:
+
 ```bash
-make testNatIntegration STORAGE_INTEGRATION_TEST_INCLUDES=reachable
+make testNatIntegration
 ```
 
-Runs this scenario (omit the var to run every NAT scenario). Builds the shared
-image and runs `testreachable.nim`, which brings the compose topology up and
-down. Rootless, but needs the host netfilter modules — if the router fails on
-iptables: `sudo modprobe iptable_nat nf_conntrack`.
+Just this one — same `STORAGE_INTEGRATION_TEST_INCLUDES` filter as testIntegration,
+with the test file path:
+
+```bash
+make testNatIntegration \
+  STORAGE_INTEGRATION_TEST_INCLUDES=tests/integration/nat/reachable/testreachable.nim
+```
+
+Builds the shared image and brings the compose topology up and down. Rootless, but
+needs the host netfilter modules — if the router fails on iptables:
+`sudo modprobe iptable_nat nf_conntrack`.
 
 ## Expected result
 
diff --git a/tests/testIntegration.nim b/tests/testIntegration.nim
index 488e4136..c5f576ef 100644
--- a/tests/testIntegration.nim
+++ b/tests/testIntegration.nim
@@ -13,6 +13,6 @@ when includes != "":
 else:
   # all tests in integration/, except the nat/ real-topology scenarios, which
   # need podman + the storage-nat image and run via testNatIntegration instead
-  importTests(currentSourcePath().parentDir() / "integration", "/nat/", "")
+  importTests(currentSourcePath().parentDir() / "integration", "/nat/")
 
 {.warning[UnusedImport]: off.}
diff --git a/tests/testNatIntegration.nim b/tests/testNatIntegration.nim
index d5d116c0..5e16eee5 100644
--- a/tests/testNatIntegration.nim
+++ b/tests/testNatIntegration.nim
@@ -1,16 +1,15 @@
 import std/os
+import std/strutils
 import ./imports
 
 ## Real-topology NAT scenarios (need podman + the storage-nat image).
-## Run a single scenario by setting its folder name during compilation, e.g.
-## STORAGE_INTEGRATION_TEST_INCLUDES=reachable
-const scenario = getEnv("STORAGE_INTEGRATION_TEST_INCLUDES")
-const only =
-  if scenario.len > 0:
-    "/" & scenario & "/"
-  else:
-    ""
+## Limit which scenarios run with STORAGE_INTEGRATION_TEST_INCLUDES, listing test
+## file paths, exactly as testIntegration does.
+const includes = getEnv("STORAGE_INTEGRATION_TEST_INCLUDES")
 
-importTests(currentSourcePath().parentDir() / "integration" / "nat", "", only)
+when includes != "":
+  importAll(includes.split(","))
+else:
+  importTests(currentSourcePath().parentDir() / "integration" / "nat", "")
 
 {.warning[UnusedImport]: off.}
diff --git a/tests/testStorage.nim b/tests/testStorage.nim
index 55b22d4b..30549b32 100644
--- a/tests/testStorage.nim
+++ b/tests/testStorage.nim
@@ -1,6 +1,6 @@
 import std/os
 import ./imports
 
-importTests(currentSourcePath().parentDir() / "storage", "", "")
+importTests(currentSourcePath().parentDir() / "storage", "")
 
 {.warning[UnusedImport]: off.}