diff --git a/kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml b/kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml
index 9ffba998..c21261e1 100644
--- a/kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml
+++ b/kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml
@@ -46,7 +46,7 @@ spec:
         k8s.v1.cni.cncf.io/networks: shelly-manager-iot
         # Changing this rolls the pod, which is the only way a change to the
         # shelly-manager-iot attachment takes effect.
-        net.renner.uno/iot-attachment-config: "tuning-no-ra"
+        net.renner.uno/iot-attachment-config: "tuning-no-ra-no-mtu-probing"
     spec:
       # eth0 (Cilium-managed pod network) is still the primary — it
       # carries the ingress, mosquitto LB return path, etc. The macvlan
diff --git a/kubernetes/apps/home-assistant-iot/shelly-manager-network-attachment.yaml b/kubernetes/apps/home-assistant-iot/shelly-manager-network-attachment.yaml
index bc4a1476..1f781267 100644
--- a/kubernetes/apps/home-assistant-iot/shelly-manager-network-attachment.yaml
+++ b/kubernetes/apps/home-assistant-iot/shelly-manager-network-attachment.yaml
@@ -50,6 +50,9 @@ spec:
   # to IPv6 clients on v30iot leave via net1, bypassing Cilium's LoadBalancer
   # reverse NAT. tuning turns RA processing off on net1; the link-local
   # address mDNS uses stays.
+  #
+  # tcp_mtu_probing (pod-wide; Cilium sets 1): Shelly flash-write stalls
+  # trip black-hole detection, which cuts firmware downloads to 48-byte MSS.
   config: |
     {
       "cniVersion": "0.3.1",
@@ -67,7 +70,8 @@ spec:
           "type": "tuning",
           "sysctl": {
             "net.ipv6.conf.IFNAME.accept_ra": "0",
-            "net.ipv6.conf.IFNAME.autoconf": "0"
+            "net.ipv6.conf.IFNAME.autoconf": "0",
+            "net.ipv4.tcp_mtu_probing": "0"
           }
         },
         {