diff --git a/kubernetes/apps/otbr/deployment.yaml b/kubernetes/apps/otbr/deployment.yaml
index 846f1526..f069b279 100644
--- a/kubernetes/apps/otbr/deployment.yaml
+++ b/kubernetes/apps/otbr/deployment.yaml
@@ -16,11 +16,12 @@ spec:
       labels:
         app.kubernetes.io/name: otbr
     spec:
-      # OTBR needs a real network namespace it can attach the wpan0 Thread
-      # interface to + IPv6 forwarding. hostNetwork on edge keeps it on the
-      # same L2 as the network-attached SLZB Thread RCP.
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
+      # Regular pod network. The only outbound this pod needs is the
+      # spinel TCP connection to slzb-thread.renner.uno:6638; everything
+      # else (HA, matter-server) talks to OTBR via the ClusterIP
+      # Service. If border-router coordination on the IoT VLAN is ever
+      # needed it gets its own Cilium-L2 LoadBalancer IP (analogous to
+      # home-assistant-iot / mosquitto-iot), not hostNetwork.
       nodeSelector:
         topology.kubernetes.io/zone: edge
       tolerations: