diff --git a/kubernetes/infrastructure/cilium/helmrelease.yaml b/kubernetes/infrastructure/cilium/helmrelease.yaml
index 78978975..5a086d2c 100644
--- a/kubernetes/infrastructure/cilium/helmrelease.yaml
+++ b/kubernetes/infrastructure/cilium/helmrelease.yaml
@@ -65,6 +65,21 @@ spec:
     kubeProxyReplacement: true
     socketLB:
       enabled: true
+    # Which links the eBPF datapath attaches to: NodePort/LoadBalancer,
+    # masquerading, and — because this names exactly one — the direct-routing
+    # device. Left empty the agent probes for links with a non-local route,
+    # which resolves to mgmt0 on all three nodes today. Naming it makes the
+    # datapath's attachment a line in git instead of a per-boot decision.
+    #
+    # mgmt0 is the only candidate: it holds the node address and both default
+    # routes. enp87s0 shares its broadcast domain but carries no address, so
+    # the probe skips it — the asymmetry behind #793, where the UDM learned
+    # the node IP against that NIC and delivered to a link with no BPF program.
+    #
+    # Not a hard binding: with no match the agent falls back to probing rather
+    # than refusing to start, so a renamed link reverts to auto-detection
+    # silently. This declares intent; it does not enforce it.
+    devices: "mgmt0"
     prometheus:
       # Without agent metrics, BPF map utilisation is invisible: a full policy
       # map only shows up as "no space left on device" in the log while pod