diff --git a/ansible/roles/netbird-proxy/tasks/main.yml b/ansible/roles/netbird-proxy/tasks/main.yml
index 8465bcdf..e4bf59bc 100644
--- a/ansible/roles/netbird-proxy/tasks/main.yml
+++ b/ansible/roles/netbird-proxy/tasks/main.yml
@@ -28,6 +28,22 @@
 - name: Apply the Docker IPv6 config before the container is deployed
   ansible.builtin.meta: flush_handlers
 
+# The reverse-proxy runs host-network as a non-root user, so binding :443
+# requires the host to permit unprivileged low ports. In bridge mode Docker
+# set ip_unprivileged_port_start=0 inside the container netns, which is why
+# the published-port setup never hit this; on the host netns the default
+# (1024) applies and the proxy crash-loops with "listen tcp :443: bind:
+# permission denied" (both members down, hit live 2026-07-26). Despite the
+# ipv4 name the sysctl governs v6 binds too. 443 is the lowest port any
+# host-network service on these single-purpose hosts needs.
+- name: Allow unprivileged bind to :443 (host-network proxy runs non-root)
+  ansible.posix.sysctl:
+    name: net.ipv4.ip_unprivileged_port_start
+    value: "443"
+    sysctl_file: /etc/sysctl.d/90-netbird-proxy.conf
+    state: present
+    reload: true
+
 # Deliberately does NOT notify "Restart netbird proxy". The "Start
 # netbird-proxy" task below runs `docker compose up -d` on every pass, which
 # already recreates exactly those services whose definition changed. Notifying