diff --git a/ansible/roles/woodpecker-agent/defaults/main.yml b/ansible/roles/woodpecker-agent/defaults/main.yml
index 8cd569b4..6c676758 100644
--- a/ansible/roles/woodpecker-agent/defaults/main.yml
+++ b/ansible/roles/woodpecker-agent/defaults/main.yml
@@ -12,3 +12,10 @@ woodpecker_max_workflows: 2
 
 # Docker Compose project directory
 woodpecker_agent_compose_dir: "/opt/woodpecker-agent"
+
+# Enable IPv6 in the agent's Docker daemon so CI step containers can reach
+# IPv6-only destinations (e.g. deploying to v6-only hosts). ULA + ip6tables
+# gives the containers NAT'd IPv6 egress through the host's own v6.
+# Requires Docker 27+ (ip6tables stable) and the host to have v6 egress.
+woodpecker_agent_docker_ipv6: true
+woodpecker_agent_docker_v6_cidr: "fd00:dead:beef::/64"
diff --git a/ansible/roles/woodpecker-agent/handlers/main.yml b/ansible/roles/woodpecker-agent/handlers/main.yml
index 23e65e32..8d8f3494 100644
--- a/ansible/roles/woodpecker-agent/handlers/main.yml
+++ b/ansible/roles/woodpecker-agent/handlers/main.yml
@@ -1,4 +1,9 @@
 ---
+- name: Restart docker
+  ansible.builtin.systemd:
+    name: docker
+    state: restarted
+
 - name: Restart woodpecker-agent
   systemd:
     name: woodpecker-agent
diff --git a/ansible/roles/woodpecker-agent/tasks/main.yml b/ansible/roles/woodpecker-agent/tasks/main.yml
index 2e577568..aacca355 100644
--- a/ansible/roles/woodpecker-agent/tasks/main.yml
+++ b/ansible/roles/woodpecker-agent/tasks/main.yml
@@ -1,4 +1,12 @@
 ---
+- name: Enable IPv6 in the Docker daemon (so CI containers can reach v6 hosts)
+  ansible.builtin.template:
+    src: daemon.json.j2
+    dest: /etc/docker/daemon.json
+    mode: "0644"
+  when: woodpecker_agent_docker_ipv6 | bool
+  notify: Restart docker
+
 - name: Create Woodpecker agent directory
   file:
     path: "{{ woodpecker_agent_compose_dir }}"
diff --git a/ansible/roles/woodpecker-agent/templates/daemon.json.j2 b/ansible/roles/woodpecker-agent/templates/daemon.json.j2
new file mode 100644
index 00000000..084e547e
--- /dev/null
+++ b/ansible/roles/woodpecker-agent/templates/daemon.json.j2
@@ -0,0 +1,5 @@
+{
+  "ipv6": true,
+  "fixed-cidr-v6": "{{ woodpecker_agent_docker_v6_cidr }}",
+  "ip6tables": true
+}