diff --git a/infrastructure/crowdsec/manifests/firewall-bouncer.yaml b/infrastructure/crowdsec/manifests/firewall-bouncer.yaml
index 947c738..0d1f23b 100644
--- a/infrastructure/crowdsec/manifests/firewall-bouncer.yaml
+++ b/infrastructure/crowdsec/manifests/firewall-bouncer.yaml
@@ -2,6 +2,34 @@
 # Blocks malicious IPs before they reach Cilium eBPF processing
 # Requires: hostNetwork + privileged (nftables management)
 # Image: community Docker build of cs-firewall-bouncer (no official image exists)
+#
+# api_url points at a headless Service (below), not the normal ClusterIP
+# crowdsec-service. Cilium's socketLB is configured hostNamespaceOnly (see
+# infrastructure/cilium/values.yaml, needed for Istio ambient compatibility),
+# which means socket-level Service translation/policy enforcement applies to
+# host-namespace traffic - and this bouncer runs hostNetwork: true, so it IS
+# host-namespace traffic. Connecting to a ClusterIP VIP from there gets an
+# immediate EPERM on connect() (confirmed live 2026-08-17, been broken since
+# this DaemonSet was first deployed 2026-03-03 - not a regression from any
+# recent change). A headless Service resolves straight to pod IPs via DNS -
+# no VIP, nothing for socket-LB to intercept - and connects cleanly.
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: crowdsec-lapi-headless
+  namespace: crowdsec
+spec:
+  clusterIP: None
+  selector:
+    k8s-app: crowdsec
+    type: lapi
+    version: v1
+  ports:
+    - name: lapi
+      port: 8080
+      protocol: TCP
+      targetPort: 8080
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -14,7 +42,7 @@ data:
     update_frequency: 10s
     log_mode: stdout
     log_level: info
-    api_url: http://crowdsec-service.crowdsec.svc:8080/
+    api_url: http://crowdsec-lapi-headless.crowdsec.svc:8080/
     api_key: ${API_KEY}
     insecure_skip_verify: false
     disable_ipv6: false