diff --git a/kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml b/kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml
index 32d530c2..46ea8d6e 100644
--- a/kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml
+++ b/kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml
@@ -94,15 +94,18 @@ spec:
                   fieldPath: status.podIP
             # 8082 and 9090 are separate pipelines in the app that answer only
             # /fw/... and /metrics; the UI and API stay on 8080.
-            # 8082 binds [::] (dual-stack, all interfaces): POD_IP is IPv4 only
-            # and the firmware LoadBalancer also serves IPv6. That includes
-            # net1, which only offers the same firmware files the LoadBalancer
-            # already serves to the IoT VLAN.
             - name: ASPNETCORE_URLS
-              value: "http://$(POD_IP):8080;http://[::]:8082;http://$(POD_IP):9090"
+              value: "http://$(POD_IP):8080;http://$(POD_IP):8082;http://$(POD_IP):9090"
+            # Both pod addresses (IPv4,IPv6). When set, the app binds all three
+            # ports to exactly these and ignores ASPNETCORE_URLS, so nothing
+            # listens on net1 and the firmware LoadBalancer gets an IPv6 listener.
+            - name: POD_IPS
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.podIPs
             # The URL devices download firmware from: Service shelly-manager-firmware.
             - name: Firmware__PublicBaseUrl
-              value: http://shelly-firmware.renner.uno
+              value: http://firmware.shelly-manager.renner.uno
             - name: ShellyManager__DnsSuffix
               value: iot.renner.uno
             # BLE radios: ESP32 esphome bluetooth_proxy nodes (e.g. the M5 Atom
diff --git a/kubernetes/apps/home-assistant-iot/shelly-manager-service.yaml b/kubernetes/apps/home-assistant-iot/shelly-manager-service.yaml
index 28cd4b58..8f4af27c 100644
--- a/kubernetes/apps/home-assistant-iot/shelly-manager-service.yaml
+++ b/kubernetes/apps/home-assistant-iot/shelly-manager-service.yaml
@@ -32,7 +32,8 @@ spec:
 ---
 # Firmware downloads for the Shelly fleet. Devices on the IoT VLAN reach it over
 # the UDM's BGP routes (like mosquitto-iot) by the name
-# shelly-firmware.renner.uno, which shelly-manager hands them in the update URL.
+# firmware.shelly-manager.renner.uno, which shelly-manager hands them in the
+# update URL.
 # The app serves only /fw/... on this port. Ingress: shelly-manager-firmware-
 # world-ingress in network-policies/home-assistant-ns.yaml.
 apiVersion: v1
@@ -45,10 +46,10 @@ metadata:
     lb-pool: bgp
     dns.renner.uno/internal: "true"
   annotations:
-    # Pinned like the other bgp-pool Services: auto-assignment hands out the
-    # pool's first address, 10.2.99.0, which is not reachable.
+    # Pinned like the other bgp-pool Services, which auto-assignment would give
+    # the pool's base address 10.2.99.0 (see trmnl/device-service.yaml).
     lbipam.cilium.io/ips: "10.2.99.90,fd99::8a"
-    external-dns.kubernetes.io/hostname: shelly-firmware.renner.uno
+    external-dns.kubernetes.io/hostname: firmware.shelly-manager.renner.uno
 spec:
   type: LoadBalancer
   externalTrafficPolicy: Local