diff --git a/kubernetes/apps/home-assistant/mosquitto-iot-service.yaml b/kubernetes/apps/home-assistant/mosquitto-iot-service.yaml
index 3a07432f..2b223d09 100644
--- a/kubernetes/apps/home-assistant/mosquitto-iot-service.yaml
+++ b/kubernetes/apps/home-assistant/mosquitto-iot-service.yaml
@@ -22,13 +22,7 @@ metadata:
     external-dns.alpha.kubernetes.io/hostname: mqtt.renner.uno
 spec:
   type: LoadBalancer
-  # ETP=Cluster (not Local) so the broker pod can be scheduled anywhere.
-  # Inbound IoT-VLAN traffic still arrives on k8s-edge (only node with
-  # v30iot), but kube-proxy/Cilium forwards to any backend cluster-wide.
-  # Source-IP preservation is lost — broker logs see a cluster node IP
-  # rather than the IoT device IP. Acceptable here: source-IP ACLs are
-  # not a security mechanism, mosquitto authn is via password/TLS.
-  externalTrafficPolicy: Cluster
+  externalTrafficPolicy: Local
   selector:
     app.kubernetes.io/name: mosquitto
   ports:
diff --git a/kubernetes/apps/home-assistant/vscode-service.yaml b/kubernetes/apps/home-assistant/vscode-service.yaml
index 9d5cd593..4e05642f 100644
--- a/kubernetes/apps/home-assistant/vscode-service.yaml
+++ b/kubernetes/apps/home-assistant/vscode-service.yaml
@@ -13,6 +13,7 @@ metadata:
     lb-pool: bgp
 spec:
   type: LoadBalancer
+  externalTrafficPolicy: Local
   selector:
     app.kubernetes.io/name: home-assistant
   ports:
diff --git a/kubernetes/apps/monitoring/helmrelease-alloy-syslog.yaml b/kubernetes/apps/monitoring/helmrelease-alloy-syslog.yaml
index 39ee12a3..a4756151 100644
--- a/kubernetes/apps/monitoring/helmrelease-alloy-syslog.yaml
+++ b/kubernetes/apps/monitoring/helmrelease-alloy-syslog.yaml
@@ -235,11 +235,7 @@ metadata:
     external-dns.alpha.kubernetes.io/hostname: syslog.k.renner.uno
 spec:
   type: LoadBalancer
-  # ETP=Cluster: matches the house pattern for the default 10.2.40.64-95
-  # services pool (ingress-nginx, kube-dns-lb). With L3 routing through the
-  # UDM gateway, ETP=Local would land traffic on a non-backend node and
-  # produce TCP RST / silent UDP drop — only L2-reachable clients would work.
-  externalTrafficPolicy: Cluster
+  externalTrafficPolicy: Local
   selector:
     app.kubernetes.io/name: alloy
     app.kubernetes.io/instance: alloy-syslog
diff --git a/kubernetes/apps/paperless/ftp-scanner.yaml b/kubernetes/apps/paperless/ftp-scanner.yaml
index cba92806..e743225a 100644
--- a/kubernetes/apps/paperless/ftp-scanner.yaml
+++ b/kubernetes/apps/paperless/ftp-scanner.yaml
@@ -123,13 +123,7 @@ metadata:
     external-dns.alpha.kubernetes.io/hostname: ftp.paperless.renner.uno
 spec:
   type: LoadBalancer
-  # ETP=Cluster: scanner sits on a different VLAN, so the L2 lease can
-  # land on any node. ETP=Local would RST connections whenever the lease
-  # holder didn't host the pod (Cilium L2 lease ≠ pod-locality).
-  # See `cilium-l2-etp-local-l3-routing-trap` in the wiki. The
-  # allow-ftp-scanner CNP permits world+host+remote-node so masquerade
-  # vs. world identity doesn't matter here.
-  externalTrafficPolicy: Cluster
+  externalTrafficPolicy: Local
   selector:
     app.kubernetes.io/name: ftp-scanner
   ports:
diff --git a/kubernetes/apps/paperless/syncthing.yaml b/kubernetes/apps/paperless/syncthing.yaml
index bf584338..c5fba5a8 100644
--- a/kubernetes/apps/paperless/syncthing.yaml
+++ b/kubernetes/apps/paperless/syncthing.yaml
@@ -148,7 +148,7 @@ metadata:
     external-dns.alpha.kubernetes.io/hostname: syncthing.paperless.renner.uno
 spec:
   type: LoadBalancer
-  externalTrafficPolicy: Cluster
+  externalTrafficPolicy: Local
   selector:
     app.kubernetes.io/name: syncthing
   ports:
diff --git a/kubernetes/infrastructure/coredns-config/service.yaml b/kubernetes/infrastructure/coredns-config/service.yaml
index 19a8b71b..64e521a5 100644
--- a/kubernetes/infrastructure/coredns-config/service.yaml
+++ b/kubernetes/infrastructure/coredns-config/service.yaml
@@ -11,6 +11,7 @@ metadata:
     io.cilium/lb-ipam-ips: "10.2.99.83,fd99::83"
 spec:
   type: LoadBalancer
+  externalTrafficPolicy: Local
   ipFamilyPolicy: PreferDualStack
   ipFamilies:
     - IPv4
diff --git a/kubernetes/infrastructure/traefik/helmrelease.yaml b/kubernetes/infrastructure/traefik/helmrelease.yaml
index d37ee9bc..eb162ba9 100644
--- a/kubernetes/infrastructure/traefik/helmrelease.yaml
+++ b/kubernetes/infrastructure/traefik/helmrelease.yaml
@@ -88,6 +88,7 @@ spec:
       enabled: true
       spec:
         type: LoadBalancer
+        externalTrafficPolicy: Local
         ipFamilyPolicy: PreferDualStack
         ipFamilies:
           - IPv4