diff --git a/tests/sys/netpfil/pf/if_enc.sh b/tests/sys/netpfil/pf/if_enc.sh
--- a/tests/sys/netpfil/pf/if_enc.sh
+++ b/tests/sys/netpfil/pf/if_enc.sh
@@ -172,10 +172,10 @@
 	jexec bgw sysctl net.inet.ipsec.filtertunnel=0
 	jexec bgw sysctl net.enc.in.ipsec_filter_mask=2		# after stripping
 	jexec bgw sysctl net.enc.out.ipsec_filter_mask=1	# before outer header
-	echo '
-		rdr on enc0 proto tcp to 4.0.0.1 port 666 -> 4.0.0.44
-		pass
-	' | jexec bgw pfctl -ef-
+	jexec bgw pfctl -e
+	pft_set_rules bgw \
+		"rdr on enc0 proto tcp to 4.0.0.1 port 666 -> 4.0.0.44" \
+		"pass"
 
 	# Prepare the catcher on host b
 	echo "unexpected" > ./receiver