diff --git a/kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml b/kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml
index 638c8b51..f914a628 100644
--- a/kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml
+++ b/kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml
@@ -91,8 +91,12 @@ spec:
                   fieldPath: status.podIP
             # 8082 and 9090 are separate pipelines in the app that answer only
             # /fw/... and /metrics; the UI and API stay on 8080.
+            # 8082 binds [::] (dual-stack, all interfaces): POD_IP is IPv4 only
+            # and the firmware LoadBalancer also serves IPv6. That includes
+            # net1, which only offers the same firmware files the LoadBalancer
+            # already serves to the IoT VLAN.
             - name: ASPNETCORE_URLS
-              value: "http://$(POD_IP):8080;http://$(POD_IP):8082;http://$(POD_IP):9090"
+              value: "http://$(POD_IP):8080;http://[::]:8082;http://$(POD_IP):9090"
             # The URL devices download firmware from: Service shelly-manager-firmware.
             - name: Firmware__PublicBaseUrl
               value: http://shelly-firmware.renner.uno
diff --git a/kubernetes/apps/home-assistant-iot/shelly-manager-service.yaml b/kubernetes/apps/home-assistant-iot/shelly-manager-service.yaml
index 34bda9ef..28cd4b58 100644
--- a/kubernetes/apps/home-assistant-iot/shelly-manager-service.yaml
+++ b/kubernetes/apps/home-assistant-iot/shelly-manager-service.yaml
@@ -45,6 +45,9 @@ metadata:
     lb-pool: bgp
     dns.renner.uno/internal: "true"
   annotations:
+    # Pinned like the other bgp-pool Services: auto-assignment hands out the
+    # pool's first address, 10.2.99.0, which is not reachable.
+    lbipam.cilium.io/ips: "10.2.99.90,fd99::8a"
     external-dns.kubernetes.io/hostname: shelly-firmware.renner.uno
 spec:
   type: LoadBalancer