diff --git a/kubernetes/infrastructure/cilium/helmrelease.yaml b/kubernetes/infrastructure/cilium/helmrelease.yaml
index d216cda1..4d58d799 100644
--- a/kubernetes/infrastructure/cilium/helmrelease.yaml
+++ b/kubernetes/infrastructure/cilium/helmrelease.yaml
@@ -34,6 +34,11 @@ spec:
     ipam:
       mode: kubernetes
     kubeProxyReplacement: true
+    bpf:
+      # Let pods reach the cluster's own LoadBalancer external IPs; Cilium
+      # redirects the socket directly to the backend pod instead of sending
+      # traffic out to the VIP and back (which fails with L2 announcements).
+      lbExternalClusterIP: true
     # Talos-specific settings
     securityContext:
       capabilities: