diff --git a/clusters/base/cluster-vars.yaml b/clusters/base/cluster-vars.yaml
index a1773e1..998f5b3 100644
--- a/clusters/base/cluster-vars.yaml
+++ b/clusters/base/cluster-vars.yaml
@@ -41,8 +41,11 @@ data:
   PIA_REGION: "SE Stockholm"                 # operator's choice (Sweden). PIA's OpenVPN region name is
                                              # "SE Stockholm" — PF-capable (NOT "SE Streaming Optimized",
                                              # which lacks PF; NOT a US region, which also lack PF)
-  CLUSTER_POD_CIDR: "10.0.0.0/8"             # Cilium cluster-pool pod CIDR (pods get 10.x); Gluetun
-                                             # FIREWALL_OUTBOUND_SUBNETS = allow these to egress via the tunnel
+  CLUSTER_POD_CIDR: "10.0.0.0/16"            # Gluetun FIREWALL_OUTBOUND_SUBNETS (bypass for steered client pods).
+                                             # NARROWED from the /8 cluster-pool: /8 overlaps PIA's tunnel gateway
+                                             # 10.31.128.1, so gluetun routed PIA's own PF gateway AROUND the tunnel
+                                             # → port forwarding timed out. /16 covers actual pod allocations
+                                             # (Cilium assigns /24 per node from 10.0.0.0 up) and excludes 10.31.x.
   # NOTE: Phase-3 VPN uses PIA's default OpenVPN UDP port + gluetun's server-list UPDATER (the bundled list
   # was stale, dialing retired IPs). Port/region are not cluster-vars (see gluetun-gateway.yaml). See DECISIONS-LOG.