I've found the root of the problem: I was connecting to libvirt via ssh using an unprivileged user part of the libvirt group. That works for most of the tasks but not for creating the firewalld libvirt zone. Using root, while being less than ideal, works fine.