diff --git a/packages-private/dts-test/h.test-d.ts b/packages-private/dts-test/h.test-d.ts
index a199e14ced9..0299c44b35d 100644
--- a/packages-private/dts-test/h.test-d.ts
+++ b/packages-private/dts-test/h.test-d.ts
@@ -25,6 +25,8 @@ describe('h inference w/ element', () => {
   h('div', { ref: 'foo' })
   h('div', { ref: ref(null) })
   h('div', { ref: _el => {} })
+  h('form', { ref: (_el: HTMLFormElement | null) => {} })
+  h('div', { ref: (_el: HTMLDivElement | null) => {} })
   //  @ts-expect-error
   h('div', { ref: [] })
   //  @ts-expect-error
diff --git a/packages/runtime-core/src/vnode.ts b/packages/runtime-core/src/vnode.ts
index 37ba85eb9ce..4411c797f6c 100644
--- a/packages/runtime-core/src/vnode.ts
+++ b/packages/runtime-core/src/vnode.ts
@@ -87,10 +87,14 @@ export type VNodeTypes =
 export type VNodeRef =
   | string
   | Ref
-  | ((
-      ref: Element | ComponentPublicInstance | null,
-      refs: Record<string, any>,
-    ) => void)
+  | {
+      // Bivariant callback param allows assigning more specific element types,
+      // e.g. (el: HTMLFormElement | null) => void for <form ref="...">.
+      bivarianceHack(
+        ref: Element | ComponentPublicInstance | null,
+        refs: Record<string, any>,
+      ): void
+    }['bivarianceHack']
 
 export type VNodeNormalizedRefAtom = {
   /**