diff --git a/packages-private/dts-test/h.test-d.ts b/packages-private/dts-test/h.test-d.ts
index 10063116f41..839602a0321 100644
--- a/packages-private/dts-test/h.test-d.ts
+++ b/packages-private/dts-test/h.test-d.ts
@@ -25,6 +25,9 @@ describe('h inference w/ element', () => {
   h('div', { ref: 'foo' })
   h('div', { ref: ref(null) })
   h('div', { ref: _el => {} })
+  h('form', { ref: (_el: HTMLFormElement | null) => {} })
+  // @ts-expect-error ref callback parameter must still be element-compatible
+  h('form', { ref: (_el: number | null) => {} })
   //  @ts-expect-error
   h('div', { ref: [] })
   //  @ts-expect-error
diff --git a/packages/runtime-core/src/vnode.ts b/packages/runtime-core/src/vnode.ts
index 30d7fdfda17..99f4636518b 100644
--- a/packages/runtime-core/src/vnode.ts
+++ b/packages/runtime-core/src/vnode.ts
@@ -87,10 +87,13 @@ export type VNodeTypes =
 export type VNodeRef =
   | string
   | Ref
-  | ((
-      ref: Element | ComponentPublicInstance | null,
-      refs: Record<string, any>,
-    ) => void)
+  | {
+      // allow callbacks to use a more specific element type
+      bivarianceHack(
+        ref: Element | ComponentPublicInstance | null,
+        refs: Record<string, any>,
+      ): void
+    }['bivarianceHack']
 
 export type VNodeNormalizedRefAtom = {
   /**