diff --git a/ansible/inventory/group_vars/edge_host/vault.yml b/ansible/inventory/group_vars/edge_host/vault.yml
new file mode 100644
index 00000000..a94e2b6f
--- /dev/null
+++ b/ansible/inventory/group_vars/edge_host/vault.yml
@@ -0,0 +1,18 @@
+$ANSIBLE_VAULT;1.1;AES256
+66366335386261303463626230383532323132366232373839643563643531666662383366313336
+6562666333613539396234363135306238323662343132380a636631303364356564656536633164
+62373531663635633139373231343434393035646263373833623636613133653561353266383064
+3261663765316431620a343665653835363433373637616538396163376366353235653561663364
+30353532373061633139623032373263376339616334623931636537633263663237663466636461
+39646165343961316364613431393563356562646438346466653133313264366562393164666633
+64616164333235653734313562303864633534303037306332613934386238313764656465333465
+63363936653566326534333434633631316536336537656334656661663637353830333237356532
+66323566356138633161383334363334663035313762636561626466613165333065623136663537
+62623863373465316636643933323539303232653263636462646363383861353932366138353233
+37303363313362306364303062663435653335343561373934366433306439616431323365636365
+64363837353466396130643962343134376361343431383631336565633866623037613065346364
+61373664653634656135373466373038626533376361373862316562623035306632333533333231
+37353665623738623534353965303634663331613433623661343338666530313863313731316337
+37616364633261356361383937376132333636663464326336343439626666313636373436633338
+63663730323134376536663562633034323339643537393937336362633333373434643037663331
+3634
diff --git a/ansible/roles/edge-host/tasks/main.yml b/ansible/roles/edge-host/tasks/main.yml
index b88c47b0..37798fc9 100644
--- a/ansible/roles/edge-host/tasks/main.yml
+++ b/ansible/roles/edge-host/tasks/main.yml
@@ -29,6 +29,9 @@
     state: started
     enabled: true
 
+# No docker daemon.json needed: both services run with network_mode: host
+# (real host addresses, v4+v6, no bridge/NAT) — see docker-compose.yml.j2.
+
 # --- Directory layout ---
 - name: Create service directories
   ansible.builtin.file:
diff --git a/ansible/roles/edge-host/templates/docker-compose.yml.j2 b/ansible/roles/edge-host/templates/docker-compose.yml.j2
index 53c510aa..cd14d67d 100644
--- a/ansible/roles/edge-host/templates/docker-compose.yml.j2
+++ b/ansible/roles/edge-host/templates/docker-compose.yml.j2
@@ -5,6 +5,9 @@
 # No `privileged` needed here: docker's --device handles the device-cgroup
 # grant that hostPath in k8s could not (that was the only reason the pods
 # ran privileged).
+# Both services use host networking: real host addresses (v4+v6), no
+# bridge, no NAT. The broker LB is IPv6-first and docker bridge NAT66 is
+# a tarpit (unmasqueraded SYNs die silently); the host stack just works.
 services:
   zwave-js:
     image: {{ edge_zwavejs_image }}
@@ -25,14 +28,19 @@ services:
       # settings.json is edited via the UI and persists here; zwave.port
       # stays /dev/zwave.
       - ./zwave-js/store:/usr/src/app/store
-    ports:
-      - "3000:3000"   # Z-Wave JS websocket — HA zwave_js integration
-      - "8091:8091"   # web UI
+    # Host networking: binds 3000 (Z-Wave JS websocket for HA) and 8091
+    # (web UI) directly on the host.
+    network_mode: host
 
   sml2mqtt:
     image: {{ edge_sml2mqtt_image }}
     container_name: sml2mqtt
     restart: unless-stopped
+    # Outbound-only (serial in, MQTT out) — host networking sidesteps the
+    # docker NAT66 gap: the broker LB is IPv6-first and bridge-network v6
+    # SYNs leave unmasqueraded and die. The host stack reaches fd99::81
+    # fine (open3e proves it continuously).
+    network_mode: host
     # Serial exclusivity: this is the ONLY reader of the meter port —
     # HA's edl21 integration stays disabled (see sml2mqtt-config comment
     # history in the k8s repo).