diff --git a/kubernetes/infrastructure/cilium/helmrelease.yaml b/kubernetes/infrastructure/cilium/helmrelease.yaml
index 108241df..b76733f3 100644
--- a/kubernetes/infrastructure/cilium/helmrelease.yaml
+++ b/kubernetes/infrastructure/cilium/helmrelease.yaml
@@ -77,6 +77,21 @@ spec:
       # redirects the socket directly to the backend pod instead of sending
       # traffic out to the VIP and back (which fails with L2 announcements).
       lbExternalClusterIP: true
+      # VLAN ids whose tagged frames are passed to the stack instead of being
+      # dropped by Cilium's VLAN filter. Unset, the filter drops every tagged
+      # frame the datapath sees — which is what strands the v30iot macvlan
+      # pods on a converted node: there `ens19` (VLAN 30) and `mgmt0`
+      # (VLAN 40) are VLAN sub-interfaces of the enp2s0f0np0 trunk, so a
+      # macvlan child's DHCP DISCOVER leaves tagged and dies as
+      # DROP_VLAN_FILTER. The CNI DHCP daemon reports that as "no buffer
+      # space available" (a tc drop surfaces to an AF_PACKET sender as
+      # ENOBUFS, not as a timeout) and the pod sits in ContainerCreating
+      # forever — issue #592, predicted in RUNBOOK-baremetal-conversion.md.
+      # Lists only the two VLANs a node terminates; [0] would bypass the
+      # filter for every id. Takes effect on agent restart.
+      # Keep in lockstep with vlan-bpf-bypass in
+      # kubernetes/talos/patches/cilium-cni.yaml and kubernetes/talos/cilium.yaml.
+      vlanBypass: [30, 40]
     cni:
       # Multus (kubernetes/infrastructure/multus) runs alongside Cilium and
       # writes 00-multus.conf to /etc/cni/net.d so kubelet picks multus
diff --git a/kubernetes/talos/cilium.yaml b/kubernetes/talos/cilium.yaml
index 97df107c..b4238075 100644
--- a/kubernetes/talos/cilium.yaml
+++ b/kubernetes/talos/cilium.yaml
@@ -306,6 +306,12 @@ data:
   # Specifies the ratio (0.0-1.0] of total system memory to use for dynamic
   # sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps.
   bpf-map-dynamic-size-ratio: "0.0025"
+  # VLAN ids whose tagged frames bypass the eBPF datapath rather than being
+  # dropped by the VLAN filter. 30 (v30iot, the macvlan parent) and 40 (mgmt)
+  # are VLAN sub-interfaces of the trunk on a bare-metal node. Keep in lockstep
+  # with patches/cilium-cni.yaml and values.bpf.vlanBypass in
+  # kubernetes/infrastructure/cilium/helmrelease.yaml.
+  vlan-bpf-bypass: "30,40"
   # bpf-policy-map-max specifies the maximum number of entries in endpoint
   # policy map (per endpoint). Keep in lockstep with patches/cilium-cni.yaml and
   # values.bpf.policyMapMax in kubernetes/infrastructure/cilium/helmrelease.yaml.
diff --git a/kubernetes/talos/patches/cilium-cni.yaml b/kubernetes/talos/patches/cilium-cni.yaml
index 57ec25a1..ef6e1db0 100644
--- a/kubernetes/talos/patches/cilium-cni.yaml
+++ b/kubernetes/talos/patches/cilium-cni.yaml
@@ -324,6 +324,13 @@ cluster:
           # Specifies the ratio (0.0-1.0] of total system memory to use for dynamic
           # sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps.
           bpf-map-dynamic-size-ratio: "0.0025"
+          # VLAN ids whose tagged frames bypass the eBPF datapath rather than being
+          # dropped by the VLAN filter. 30 (v30iot, the macvlan parent) and 40 (mgmt)
+          # are VLAN sub-interfaces of the trunk on a bare-metal node, so without this
+          # a cold rebuild comes up with the v30iot macvlan pods unable to DHCP. Keep
+          # in lockstep with kubernetes/talos/cilium.yaml and values.bpf.vlanBypass in
+          # kubernetes/infrastructure/cilium/helmrelease.yaml.
+          vlan-bpf-bypass: "30,40"
           # bpf-policy-map-max specifies the maximum number of entries in endpoint
           # policy map (per endpoint). Keep in lockstep with values.bpf.policyMapMax
           # in kubernetes/infrastructure/cilium/helmrelease.yaml, and with the third