diff --git a/kubernetes/apps/home-assistant/mqtt-accounts.yaml b/kubernetes/apps/home-assistant/mqtt-accounts.yaml
index c6011902..b9192166 100644
--- a/kubernetes/apps/home-assistant/mqtt-accounts.yaml
+++ b/kubernetes/apps/home-assistant/mqtt-accounts.yaml
@@ -66,6 +66,13 @@
   auth: password
   deliver: {esp32: "https://edge-2.iot.renner.uno:8443"}
   acl: ["readwrite open3e/#"]
+# vitocal-can: open3e-esp32 CAN gateway at the Vitocal 250-A (S28-28).
+# The firmware registers its compiled-in DHCP name `open3e`, not its
+# configured hostname.
+- name: vitocal-can
+  auth: password
+  deliver: {esp32: "http://open3e.iot.renner.uno"}
+  acl: ["readwrite open3e/#"]
 # Shellies (REN-1017): one password account per device, pushed by the
 # controller through shelly-manager's per-device API. Name shelly-<id> =
 # shelly-manager device id. ACL as the former shared user `shellies`
diff --git a/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml b/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml
index 971677d0..236d02b0 100644
--- a/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml
+++ b/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml
@@ -492,7 +492,7 @@ spec:
             - port: "6638"
               protocol: TCP
 ---
-# mqtt-account-controller: credential delivery to edge-1 (deliver.esp32 in mqtt-accounts.yaml).
+# mqtt-account-controller: credential delivery to deliver.esp32 targets in mqtt-accounts.yaml.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
@@ -524,6 +524,13 @@ spec:
         - ports:
             - port: "8443"
               protocol: TCP
+    # vitocal-can (open3e-esp32), plain HTTP API.
+    - toFQDNs:
+        - matchName: "open3e.iot.renner.uno"
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
 ---
 # whisper and speech-to-phrase: model downloads over HTTPS.
 apiVersion: cilium.io/v2