diff --git a/kubernetes/apps/trmnl/device-service.yaml b/kubernetes/apps/trmnl/device-service.yaml
index c8c1bf15..f7f5e202 100644
--- a/kubernetes/apps/trmnl/device-service.yaml
+++ b/kubernetes/apps/trmnl/device-service.yaml
@@ -9,8 +9,19 @@
 #
 # Same shape as home-assistant-bgp: a dedicated address on the Cilium BGP
 # pool rather than a TLS-less Ingress, which would be a new pattern for this
-# repo. The device is provisioned with the HOSTNAME, not the address, so the
-# lease can move without re-provisioning hardware.
+# repo. The device is provisioned with the HOSTNAME, not the address.
+#
+# The address is requested explicitly, matching every other LB service here.
+# Left to allocate freely, Cilium IPAM handed out the first free address in
+# the pool block (10.2.99.0-10.2.99.255) — which is 10.2.99.0, the base
+# address of the range. Each LB address is advertised to the UDM as its own
+# BGP route so that is routable in principle, but a .0 host address is the
+# kind of thing constrained embedded IP stacks get wrong, and the TRMNL
+# firmware is the single client that has to work here. Not worth the risk
+# for an address nobody chose on purpose.
+#
+# .89 continues the existing sequence (.81-.88 are in use) and matches the
+# fd99::89 that IPAM had already picked for v6.
 apiVersion: v1
 kind: Service
 metadata:
@@ -21,6 +32,7 @@ metadata:
     lb-pool: bgp
   annotations:
     external-dns.alpha.kubernetes.io/hostname: trmnl-device.renner.uno
+    lbipam.cilium.io/ips: "10.2.99.89,fd99::89"
 spec:
   type: LoadBalancer
   externalTrafficPolicy: Local
diff --git a/kubernetes/apps/trmnl/terminus.yaml b/kubernetes/apps/trmnl/terminus.yaml
index e7587a2c..339d7ee3 100644
--- a/kubernetes/apps/trmnl/terminus.yaml
+++ b/kubernetes/apps/trmnl/terminus.yaml
@@ -124,6 +124,16 @@ spec:
           envFrom:
             - configMapRef:
                 name: terminus-config
+          # EXPECTED on a fresh deploy: this container loses the race against
+          # the web container's migration and exits 1 with
+          # `PG::UndefinedTable: relation "account" does not exist`, then
+          # comes up healthy on the restart once the schema exists.
+          # Observed on first deploy 2026-08-10; converged in ~1s. There is
+          # no upstream ordering hook, and gating it behind an initContainer
+          # that probes for a specific table would couple us to Terminus's
+          # schema. So this is left to Kubernetes' restart, deliberately —
+          # a single sidekiq restart shortly after a rollout is benign. More
+          # than a couple, or restarts long after a rollout, are NOT this.
           env:
             # No APP_SETUP here — see the web container.
             - name: DATABASE_URL