diff --git a/infra/ansible/inventory/group_vars/all.yml b/infra/ansible/inventory/group_vars/all.yml
index 0404baf..207db75 100644
--- a/infra/ansible/inventory/group_vars/all.yml
+++ b/infra/ansible/inventory/group_vars/all.yml
@@ -11,3 +11,9 @@ ansible_user: k3s
 # HelmRelease stay in PARITY (docs/02 contract).
 k3s_api_host: "{{ hostvars[groups['k3s_primary'][0]]['k3s_node_ip'] }}"
 k3s_api_port: 6443
+
+# Controller (dev container) reaches the kube-API through an SSH tunnel
+# (local 127.0.0.1:16443 -> primary 127.0.0.1:6443), because the API port is not
+# NAT-forwarded and 192.168.1.50:6443 is unroutable from the dev host. Only the
+# controller kubeconfig uses this; k8sServiceHost (in-cluster) stays the real node IP.
+cluster_controller_api_server: "https://127.0.0.1:16443"
diff --git a/infra/ansible/roles/cilium/tasks/main.yml b/infra/ansible/roles/cilium/tasks/main.yml
index b3be9a4..7393b4c 100644
--- a/infra/ansible/roles/cilium/tasks/main.yml
+++ b/infra/ansible/roles/cilium/tasks/main.yml
@@ -24,8 +24,7 @@
   ansible.builtin.copy:
     content: >-
       {{ k3s_kubeconfig_raw.content | b64decode
-         | regex_replace('https://127.0.0.1:6443',
-                         'https://' ~ k3s_api_host ~ ':' ~ k3s_api_port) }}
+         | regex_replace('https://127.0.0.1:6443', cluster_controller_api_server) }}
     dest: "{{ cilium_kubeconfig }}"
     mode: "0600"
   delegate_to: localhost