diff --git a/infrastructure/ha-failover/manifests/etcd.yaml b/infrastructure/ha-failover/manifests/etcd.yaml
index 759ab89..6e33c6d 100644
--- a/infrastructure/ha-failover/manifests/etcd.yaml
+++ b/infrastructure/ha-failover/manifests/etcd.yaml
@@ -9,11 +9,23 @@
 #
 # Pinned to a specific node (talos-cp-01) via nodeSelector so its
 # advertised peer/client URLs (which must be stable, not "whichever node
-# it landed on today") stay correct. Reachable from the VPS/witness via
-# that node's real IP - confirmed live 2026-08-19 that home nodes are
-# directly reachable from Netbird mesh peers on their node IP (the
-# netbird-egress DaemonSet's route) - and exposed via a NodePort Service,
-# which needs infrastructure/kyverno/policies/ha-failover-nodeport-exception.yaml
+# it landed on today") stay correct.
+#
+# Reachable from the VPS/witness via a UniFi WAN port-forward + a
+# source-IP-restricted WAN_IN firewall rule (limited to just the VPS and
+# witness public IPs) - NOT via the Netbird mesh directly. talos-cp-01
+# does have a real, host-bound Netbird IP (100.108.42.109 on its wt0
+# interface, confirmed live via `talosctl get addresses`), but that's a
+# dead end for inbound WAN traffic: UniFi's router only has a route to
+# its own directly-connected LAN (172.28.101.0/24), nothing advertises
+# 100.108.0.0/16 to it, so a port-forward targeting the Netbird IP would
+# never actually route. The port-forward instead targets talos-cp-01's
+# real LAN IP (172.28.101.41) - NodePort Services bind on every interface
+# on a node, so the same ports are reachable there too, and that's an
+# address UniFi can actually route to natively.
+#
+# The NodePort Service itself needs
+# infrastructure/kyverno/policies/ha-failover-nodeport-exception.yaml
 # (disallow-nodeport-services is enforced cluster-wide otherwise).
 apiVersion: v1
 kind: Namespace
@@ -56,10 +68,10 @@ spec:
             - --name=home
             - --data-dir=/var/lib/etcd/data
             - --listen-client-urls=http://0.0.0.0:2379
-            - --advertise-client-urls=http://100.108.42.109:32379
+            - --advertise-client-urls=http://home.kube.huskypup.net:12379
             - --listen-peer-urls=http://0.0.0.0:2380
-            - --initial-advertise-peer-urls=http://100.108.42.109:32380
-            - --initial-cluster=home=http://100.108.42.109:32380,vps=http://100.108.113.41:2380,witness=http://100.108.130.74:2380
+            - --initial-advertise-peer-urls=http://home.kube.huskypup.net:12380
+            - --initial-cluster=home=http://home.kube.huskypup.net:12380,vps=http://100.108.113.41:2380,witness=http://100.108.130.74:2380
             - --initial-cluster-state=new
             - --initial-cluster-token=ha-failover-quorum
           ports: