diff --git a/opentofu/modules/proxmox_lxc/main.tf b/opentofu/modules/proxmox_lxc/main.tf
index c379cfcb..b1a78d36 100644
--- a/opentofu/modules/proxmox_lxc/main.tf
+++ b/opentofu/modules/proxmox_lxc/main.tf
@@ -24,6 +24,13 @@ resource "proxmox_virtual_environment_container" "this" {
           address = var.ip_address != null ? "${var.ip_address}/24" : "dhcp"
           gateway = var.ip_address != null ? cidrhost("${var.ip_address}/24", 1) : null
         }
+        dynamic "ipv6" {
+          for_each = var.ipv6_address != null ? [1] : []
+          content {
+            address = var.ipv6_address
+            gateway = var.ipv6_gateway
+          }
+        }
       }
     }
 
@@ -97,13 +104,13 @@ resource "proxmox_virtual_environment_container" "this" {
 
   lifecycle {
     ignore_changes = [
-      node_name,         # HA migrations move containers between nodes
-      initialization,    # Hostname/user changes can cause issues
-      disk,              # Disk changes can be destructive
-      mount_point,       # Mount point changes force replacement
-      operating_system,  # Template changes would require recreation
-      features,          # API token can't modify features on privileged containers (requires root@pam)
-      network_interface  # Network changes can disrupt running services and cause connectivity issues
+      node_name,        # HA migrations move containers between nodes
+      initialization,   # Hostname/user changes can cause issues
+      disk,             # Disk changes can be destructive
+      mount_point,      # Mount point changes force replacement
+      operating_system, # Template changes would require recreation
+      features,         # API token can't modify features on privileged containers (requires root@pam)
+      network_interface # Network changes can disrupt running services and cause connectivity issues
     ]
   }
 }
diff --git a/opentofu/modules/proxmox_lxc/variables.tf b/opentofu/modules/proxmox_lxc/variables.tf
index 2aa93f5e..dd95c221 100644
--- a/opentofu/modules/proxmox_lxc/variables.tf
+++ b/opentofu/modules/proxmox_lxc/variables.tf
@@ -37,6 +37,18 @@ variable "ip_address" {
   default     = null
 }
 
+variable "ipv6_address" {
+  type        = string
+  description = "IPv6 config for the container: \"auto\" (SLAAC), \"dhcp\", or a static CIDR. null disables IPv6."
+  default     = null
+}
+
+variable "ipv6_gateway" {
+  type        = string
+  description = "IPv6 gateway (only for a static ipv6_address; leave null for auto/dhcp)."
+  default     = null
+}
+
 variable "tags" {
   type    = string
   default = ""
diff --git a/opentofu/woodpecker_agents.tf b/opentofu/woodpecker_agents.tf
index 7d3b4ba1..7ec92ef6 100644
--- a/opentofu/woodpecker_agents.tf
+++ b/opentofu/woodpecker_agents.tf
@@ -23,6 +23,9 @@ module "woodpecker_agents" {
 
   start          = each.value.state == "started" ? true : false
   network_bridge = each.value.bridge
+  # CI steps must reach IPv6-only hosts; give the LXC SLAAC v6 off v40srv so
+  # Docker has a v6 uplink to NAT the pipeline networks onto.
+  ipv6_address = "auto"
 
   features = {
     nesting = each.value.nesting