diff --git a/kubernetes/apps/home-assistant-iot/mdns-relay-deployment.yaml b/kubernetes/apps/home-assistant-iot/mdns-relay-deployment.yaml
index 632155d1..5da9e1b1 100644
--- a/kubernetes/apps/home-assistant-iot/mdns-relay-deployment.yaml
+++ b/kubernetes/apps/home-assistant-iot/mdns-relay-deployment.yaml
@@ -44,7 +44,7 @@ spec:
       annotations:
         # Bump to restart the pod and re-attach net1 (DHCP via multus).
         # 2026-10-06: first attach on containernetworking/plugins v1.9.1.
-        homelab.renner.uno/restarted-for: "2026-10-06 cni-plugins v1.9.1 attach check"
+        homelab.renner.uno/restarted-for: "2026-11-07 net1 without RA (S28-36)"
         k8s.v1.cni.cncf.io/networks: mdns-relay-iot
     spec:
       # Runs where the node patch declares the IoT VLAN (ens19).
diff --git a/kubernetes/apps/home-assistant-iot/mdns-relay-network-attachment.yaml b/kubernetes/apps/home-assistant-iot/mdns-relay-network-attachment.yaml
index 739d6cf4..63252711 100644
--- a/kubernetes/apps/home-assistant-iot/mdns-relay-network-attachment.yaml
+++ b/kubernetes/apps/home-assistant-iot/mdns-relay-network-attachment.yaml
@@ -31,6 +31,11 @@ spec:
   # dropped. The relay's forward path to Home Assistant runs over eth0, so
   # that route has to stay intact.
   #
+  # sbr covers IPv4 only. With Router Advertisements net1 gets a global IPv6
+  # address and default route in the main table, and the IPv6 forward to the
+  # Service leaves via net1 with an IoT source, which HA's CNP drops. tuning
+  # turns RA processing off; the link-local address ff02::fb needs stays.
+  #
   # Requires the cni-dhcp-daemon DaemonSet in infrastructure/multus.
   config: |
     {
@@ -45,6 +50,13 @@ spec:
             "type": "dhcp"
           }
         },
+        {
+          "type": "tuning",
+          "sysctl": {
+            "net.ipv6.conf.IFNAME.accept_ra": "0",
+            "net.ipv6.conf.IFNAME.autoconf": "0"
+          }
+        },
         {
           "type": "sbr"
         }