diff --git a/kubernetes/apps/home-assistant/shelly-manager-deployment.yaml b/kubernetes/apps/home-assistant/shelly-manager-deployment.yaml
index 619fb362..5025b34a 100644
--- a/kubernetes/apps/home-assistant/shelly-manager-deployment.yaml
+++ b/kubernetes/apps/home-assistant/shelly-manager-deployment.yaml
@@ -17,11 +17,23 @@ spec:
       labels:
         app.kubernetes.io/name: shelly-manager
       annotations:
-        # Multus attaches `net1` on v30iot with a static IP (see
+        # Multus attaches `net1` on v30iot with a DHCP-leased address (see
         # shelly-manager-network-attachment.yaml). The mDNS resolver
         # inside the app needs L2 presence on the IoT VLAN to browse
         # for `_shelly._tcp.local.` — multicast doesn't cross the L3
         # boundary between the cluster pod CIDR and v30iot.
+        #
+        # But net1 must carry ONLY multicast, not the admin HTTP server.
+        # The app has no auth of its own; its ingress is gated by Authentik
+        # (shelly-manager-gate). That gate only guards the Traefik path —
+        # macvlan traffic bypasses Cilium policy entirely, so a `0.0.0.0`
+        # bind exposes the unauthenticated UI on :8080 directly to every
+        # device on the IoT VLAN (verified 2026-07-10: GET http://<net1
+        # ip>:8080/ from the VLAN returned 200 and the full UI). See the
+        # ASPNETCORE_URLS binding below, which pins Kestrel to the pod
+        # (eth0) address so :8080 is not reachable over net1. The mDNS
+        # resolver is a separate ZeroconfResolver socket set and is
+        # unaffected.
         k8s.v1.cni.cncf.io/networks: shelly-manager-iot
     spec:
       # eth0 (Cilium-managed pod network) is still the primary — it
@@ -44,6 +56,22 @@ spec:
           env:
             - name: TZ
               value: Europe/Berlin
+            # Pin Kestrel to the pod's eth0 (cluster CIDR) address, not
+            # 0.0.0.0. The image's Dockerfile default is
+            # ASPNETCORE_URLS=http://0.0.0.0:8080, which also binds the
+            # macvlan net1 interface on the IoT VLAN — exposing the
+            # unauthenticated UI to that untrusted segment past the
+            # Authentik gate. POD_IP is the eth0 IPv4 (status.podIP); the
+            # Service, the Authentik outpost, and the kubelet httpGet
+            # probes all reach the app on that address. mDNS discovery is
+            # unaffected: ZeroconfResolver binds its own multicast sockets
+            # on net1 independently of Kestrel.
+            - name: POD_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.podIP
+            - name: ASPNETCORE_URLS
+              value: "http://$(POD_IP):8080"
           volumeMounts:
             - name: data
               mountPath: /data