diff --git a/infra/ansible/ansible.cfg b/infra/ansible/ansible.cfg
index 0d8663b..d23f4ce 100644
--- a/infra/ansible/ansible.cfg
+++ b/infra/ansible/ansible.cfg
@@ -3,7 +3,9 @@ inventory = inventory/hosts.ini
 roles_path = roles
 host_key_checking = False
 retry_files_enabled = False
-stdout_callback = yaml
+# ansible-core 2.20 removed community.general.yaml; use the builtin default with YAML result format.
+stdout_callback = default
+result_format = yaml
 interpreter_python = auto_silent
 
 [ssh_connection]
diff --git a/infra/ansible/roles/cilium/templates/cilium-values.yaml.j2 b/infra/ansible/roles/cilium/templates/cilium-values.yaml.j2
index e360506..0704adb 100644
--- a/infra/ansible/roles/cilium/templates/cilium-values.yaml.j2
+++ b/infra/ansible/roles/cilium/templates/cilium-values.yaml.j2
@@ -17,6 +17,12 @@ gatewayAPI:
 egressGateway:
   enabled: true
 
+# Egress Gateway REQUIRES masquerade (ipv4 + eBPF). eBPF masquerade is the correct
+# pairing with kubeProxyReplacement. [parity] must match platform/cilium HelmRelease.
+enableIPv4Masquerade: true
+bpf:
+  masquerade: true
+
 # Flow observability / isolation audit (ADR-0002).
 hubble:
   enabled: true