diff --git a/opentofu/dns_renner_uno.tf b/opentofu/dns_renner_uno.tf
index ed550447..47bb982a 100644
--- a/opentofu/dns_renner_uno.tf
+++ b/opentofu/dns_renner_uno.tf
@@ -25,6 +25,12 @@ locals {
     # and is reachable from the cluster via its v6 default route) so v6
     # resolution stays local instead of falling through to the proxy.
     "udm" = { type = "AAAA", value = "fd00::1" }
+
+    # Same failure mode as `udm` above: the UniFi captive-portal hostname
+    # auto-resolves to the UDM console (captive -> 192.168.8.1) over v4 but
+    # has no AAAA, so v6 queries fall through to the *.renner.uno wildcard
+    # (proxy.renner.uno). Pin the AAAA to the same UDM management ULA.
+    "captive" = { type = "AAAA", value = "fd00::1" }
   }
 }