diff --git a/ansible/inventory/pve_hosts.yml b/ansible/inventory/pve_hosts.yml
index 9fe9c028..9147f75d 100644
--- a/ansible/inventory/pve_hosts.yml
+++ b/ansible/inventory/pve_hosts.yml
@@ -22,6 +22,7 @@ proxy-2.renner.uno ansible_host=proxy-2.nb.renner.uno ansible_user=root
 # sub-interface. Nothing here assumes any peripheral is attached.
 [edge_host]
 edge-1.iot.renner.uno ansible_user=root
+edge-2.iot.renner.uno ansible_user=root
 
 # Synology NAS (DSM): nas-1 RS1221+ on site, nas-2 DS1522+ off site.
 [synology_nas]
@@ -73,6 +74,7 @@ proxy-1.renner.uno
 proxy-2.renner.uno
 netbird.renner.uno
 edge-1.iot.renner.uno
+edge-2.iot.renner.uno
 nas-1.renner.uno
 nas-2.renner.uno
 
diff --git a/ansible/plays/install-ntp-ha.yml b/ansible/plays/install-ntp-ha.yml
index c742af64..3e39bf93 100644
--- a/ansible/plays/install-ntp-ha.yml
+++ b/ansible/plays/install-ntp-ha.yml
@@ -83,6 +83,9 @@
       edge-1.iot.renner.uno:
         priority: 70
         state: "BACKUP"
+      edge-2.iot.renner.uno:
+        priority: 60
+        state: "BACKUP"
 
   roles:
     - role: chrony-ntp-server
diff --git a/ansible/roles/mqtt-bridge/defaults/main.yml b/ansible/roles/mqtt-bridge/defaults/main.yml
index 0e85bbfc..bc809227 100644
--- a/ansible/roles/mqtt-bridge/defaults/main.yml
+++ b/ansible/roles/mqtt-bridge/defaults/main.yml
@@ -16,7 +16,7 @@ edge_mqtt_bridge_cafile: /etc/ssl/certs/ca-certificates.crt
 # kubernetes/apps/home-assistant/mqtt-accounts.yaml). The controller pushes
 # its password to edge-mqtt-cred and rotates it when the bridge reports
 # "not connected"; there is no copy in ansible-vault.
-edge_mqtt_bridge_account: edge-1
+edge_mqtt_bridge_account: "{{ inventory_hostname_short }}"
 # HTTPS port of edge-mqtt-cred (esp32 device API, mTLS). Only a client
 # certificate from the MQTT CA with this CN is accepted.
 edge_mqtt_cred_port: 8443
diff --git a/ansible/roles/mqtt-bridge/templates/edge-1-bridge.conf.in.j2 b/ansible/roles/mqtt-bridge/templates/edge-1-bridge.conf.in.j2
index f23b9ace..6967adbc 100644
--- a/ansible/roles/mqtt-bridge/templates/edge-1-bridge.conf.in.j2
+++ b/ansible/roles/mqtt-bridge/templates/edge-1-bridge.conf.in.j2
@@ -7,7 +7,7 @@ connection {{ edge_mqtt_bridge_account }}
 address {{ edge_mqtt_cluster_host }}:{{ edge_mqtt_cluster_tls_port }}
 bridge_cafile {{ edge_mqtt_bridge_cafile }}
 bridge_insecure false
-remote_clientid edge1-bridge
+remote_clientid {{ edge_mqtt_bridge_account | replace('-', '') }}-bridge
 cleansession false
 try_private true
 restart_timeout 5 30
diff --git a/kubernetes/apps/home-assistant/mqtt-accounts.yaml b/kubernetes/apps/home-assistant/mqtt-accounts.yaml
index 0b52fa14..c6011902 100644
--- a/kubernetes/apps/home-assistant/mqtt-accounts.yaml
+++ b/kubernetes/apps/home-assistant/mqtt-accounts.yaml
@@ -61,6 +61,11 @@
   # No sml2mqtt/#: the SML meter reader is retired for good (owner,
   # 2026-09-19; grid data comes from the E380 on the CAN bus).
   acl: ["readwrite open3e/#"]
+# edge-2's local mosquitto bridge, same role and pinning as edge-1.
+- name: edge-2
+  auth: password
+  deliver: {esp32: "https://edge-2.iot.renner.uno:8443"}
+  acl: ["readwrite open3e/#"]
 # Shellies (REN-1017): one password account per device, pushed by the
 # controller through shelly-manager's per-device API. Name shelly-<id> =
 # shelly-manager device id. ACL as the former shared user `shellies`
diff --git a/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml b/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml
index 19544b71..b48edb83 100644
--- a/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml
+++ b/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml
@@ -516,6 +516,7 @@ spec:
               - matchPattern: "*"
     - toFQDNs:
         - matchName: "edge-1.iot.renner.uno"
+        - matchName: "edge-2.iot.renner.uno"
       toPorts:
         - ports:
             - port: "8443"