diff --git a/kubernetes/infrastructure/post-crds/cilium-l2.yaml b/kubernetes/infrastructure/post-crds/cilium-l2.yaml
index 767793a5..9794b5c1 100644
--- a/kubernetes/infrastructure/post-crds/cilium-l2.yaml
+++ b/kubernetes/infrastructure/post-crds/cilium-l2.yaml
@@ -9,6 +9,12 @@ spec:
     - start: fd40::40
       stop: fd40::ff
 ---
+# default policy must NOT cover Services labelled `iot-vlan: "true"`.
+# Without this exclusion both policies match IoT services, leader
+# election runs across all nodes (default has no nodeSelector), and
+# the lease can land on a node that has no v30iot interface — making
+# the IoT LB IP unreachable until the lease happens to expire onto
+# k8s-edge.
 apiVersion: cilium.io/v2alpha1
 kind: CiliumL2AnnouncementPolicy
 metadata:
@@ -18,6 +24,10 @@ spec:
   externalIPs: true
   interfaces:
     - ^eth[0-9]+
+  serviceSelector:
+    matchExpressions:
+      - key: iot-vlan
+        operator: DoesNotExist
 ---
 # IoT VLAN pool — k8s-edge has a NIC on v30iot, so Services that need to
 # be addressable from IoT devices that can't do DNS or proxy ingress get