diff --git a/kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml b/kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml
index f914a628..32d530c2 100644
--- a/kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml
+++ b/kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml
@@ -44,6 +44,9 @@ spec:
         # reachable over net1. The mDNS resolver is a separate
         # ZeroconfResolver socket set and is unaffected.
         k8s.v1.cni.cncf.io/networks: shelly-manager-iot
+        # Changing this rolls the pod, which is the only way a change to the
+        # shelly-manager-iot attachment takes effect.
+        net.renner.uno/iot-attachment-config: "tuning-no-ra"
     spec:
       # eth0 (Cilium-managed pod network) is still the primary — it
       # carries the ingress, mosquitto LB return path, etc. The macvlan
diff --git a/kubernetes/apps/home-assistant-iot/shelly-manager-network-attachment.yaml b/kubernetes/apps/home-assistant-iot/shelly-manager-network-attachment.yaml
index b684bf0a..bc4a1476 100644
--- a/kubernetes/apps/home-assistant-iot/shelly-manager-network-attachment.yaml
+++ b/kubernetes/apps/home-assistant-iot/shelly-manager-network-attachment.yaml
@@ -44,6 +44,12 @@ spec:
   # the pod goes NotReady and its ingress returns 504. Static IPAM used to
   # dodge this by simply never setting a gateway; leased addresses come with
   # one, so it has to be confined instead of omitted.
+  #
+  # sbr covers IPv4 only. With Router Advertisements net1 gets global IPv6
+  # addresses plus on-link and default routes in the main table, and replies
+  # to IPv6 clients on v30iot leave via net1, bypassing Cilium's LoadBalancer
+  # reverse NAT. tuning turns RA processing off on net1; the link-local
+  # address mDNS uses stays.
   config: |
     {
       "cniVersion": "0.3.1",
@@ -57,6 +63,13 @@ spec:
             "type": "dhcp"
           }
         },
+        {
+          "type": "tuning",
+          "sysctl": {
+            "net.ipv6.conf.IFNAME.accept_ra": "0",
+            "net.ipv6.conf.IFNAME.autoconf": "0"
+          }
+        },
         {
           "type": "sbr"
         }