diff --git a/opentofu/dns_renner_uno.tf b/opentofu/dns_renner_uno.tf
index 90f64722..ed550447 100644
--- a/opentofu/dns_renner_uno.tf
+++ b/opentofu/dns_renner_uno.tf
@@ -12,6 +12,19 @@ locals {
 
     # Talos K8s control-plane VIP (etcd-elected, see kubernetes/talos/patches/k8s-{1,2,3}.yaml)
     "k8s" = { type = "A", value = "10.2.40.60" }
+
+    # AAAA Records
+    # UniFi auto-creates only the A record for the UDM's own hostname
+    # (udm -> 192.168.8.1) and forwards AAAA queries upstream, where the
+    # *.renner.uno wildcard answers with proxy.renner.uno (the public
+    # reverse proxy). IPv6-first clients — notably Home Assistant's UniFi
+    # Network integration — then connect to the proxy, which rejects the
+    # unknown SNI with `tlsv1 alert internal error`, flapping the
+    # integration into setup_error. Pin the AAAA to the UDM's own
+    # management ULA (fd00::1, serves the controller cert CN=udm.renner.uno
+    # and is reachable from the cluster via its v6 default route) so v6
+    # resolution stays local instead of falling through to the proxy.
+    "udm" = { type = "AAAA", value = "fd00::1" }
   }
 }