diff --git a/conformance/tests/l2-behavioral/dns-exposure/chainsaw-test.yaml b/conformance/tests/l2-behavioral/dns-exposure/chainsaw-test.yaml
index ad0bc0e..9b3eee0 100644
--- a/conformance/tests/l2-behavioral/dns-exposure/chainsaw-test.yaml
+++ b/conformance/tests/l2-behavioral/dns-exposure/chainsaw-test.yaml
@@ -7,7 +7,7 @@
 # WHEN  ExternalDNS reconciles (source=service, provider=cloudflare, policy=sync),
 # THEN  a PUBLIC DNS record for that hostname is auto-created, pointing at the
 #       Service's Cilium-assigned LB IP (R-DNS-02). The record resolves to the
-#       cluster LB IP (10.73.0.240-.250), i.e. clients reach the cluster endpoint.
+#       cluster LB IP (Cilium L2 `shared` pool 192.168.1.53-.60), i.e. clients reach the cluster endpoint.
 #
 # CLEANUP: chainsaw deletes the per-test namespace (Service included) at teardown;
 # ExternalDNS policy=sync then REMOVES the record from Cloudflare on its next pass.
@@ -83,9 +83,9 @@ spec:
                             set -u
                             host="conformance-dns.home.keithjackson.dev"
                             # Poll PUBLIC DNS (1.1.1.1) until the auto-created A record appears and
-                            # points into the cluster LB range 10.73.0.24x. Proves ExternalDNS created it.
+                            # points into the cluster LB range (Cilium L2 `shared` pool 192.168.1.53-.60). Proves ExternalDNS created it.
                             for i in $(seq 1 28); do
-                              ip="$(nslookup "$host" 1.1.1.1 2>/dev/null | grep -oE '10\.73\.0\.[0-9]+' | head -1)"
+                              ip="$(nslookup "$host" 1.1.1.1 2>/dev/null | grep -oE '192\.168\.1\.(5[3-9]|60)' | head -1)"
                               if [ -n "$ip" ]; then echo "RECORD_FOUND $host -> $ip"; exit 0; fi
                               echo "poll $i: record not yet published"; sleep 10
                             done
diff --git a/conformance/tests/l2-behavioral/dns-internal-resolution/chainsaw-test.yaml b/conformance/tests/l2-behavioral/dns-internal-resolution/chainsaw-test.yaml
index 2eee4d9..ee68a36 100644
--- a/conformance/tests/l2-behavioral/dns-internal-resolution/chainsaw-test.yaml
+++ b/conformance/tests/l2-behavioral/dns-internal-resolution/chainsaw-test.yaml
@@ -9,7 +9,7 @@
 # GIVEN the split-horizon coredns-custom ConfigMap is reconciled into k3s CoreDNS,
 # WHEN  an in-cluster pod resolves a platform hostname over its PUBLIC name
 #       (keycloak.home.keithjackson.dev) using the default cluster resolver (CoreDNS 10.43.0.10),
-# THEN  the answer is the in-cluster Gateway VIP (the L2-announced LB range 10.73.0.24x) — NOT a
+# THEN  the answer is the in-cluster Gateway VIP (the Cilium L2 `shared` gateway pool 192.168.1.53-.60) — NOT a
 #       public/off-cluster IP. This is what lets pod->public-hostname traffic hairpin through the
 #       Gateway with the correct SNI (*.home.keithjackson.dev) so the wildcard cert validates
 #       (R-DNS-01 "services reachable at <svc>.home..."; R-DNS-03 split-horizon).
@@ -35,7 +35,7 @@ metadata:
     conformance.home.k3s/executable: "true"
     conformance.home.k3s/intent: >-
       An in-cluster pod resolving keycloak.home.keithjackson.dev via cluster DNS gets the internal
-      Gateway VIP (10.73.0.24x), not the public hairpin — split-horizon in-cluster resolution.
+      Gateway VIP (192.168.1.53-.60), not the public hairpin — split-horizon in-cluster resolution.
 spec:
   timeouts:
     apply: 60s
@@ -67,15 +67,15 @@ spec:
                             host="keycloak.home.keithjackson.dev"
                             # Resolve via the DEFAULT cluster resolver (CoreDNS, /etc/resolv.conf ->
                             # 10.43.0.10). Split-horizon must answer with the in-cluster Gateway VIP
-                            # (L2 pool 10.73.0.24x), proving pods hairpin through the Gateway.
+                            # (Cilium L2 `shared` pool 192.168.1.53-.60), proving pods hairpin through the Gateway.
                             out="$(nslookup "$host" 2>/dev/null)"
                             echo "$out"
-                            ip="$(echo "$out" | awk '/^Address: /{print $2}' | grep -E '^10\.73\.0\.24[0-9]$' | head -1)"
+                            ip="$(echo "$out" | awk '/^Address: /{print $2}' | grep -E '^192\.168\.1\.(5[3-9]|60)$' | head -1)"
                             if [ -n "$ip" ]; then
                               echo "INTERNAL_RESOLUTION_OK $host -> $ip (in-cluster Gateway VIP)"
                               exit 0
                             fi
-                            echo "FAIL: $host did not resolve to the in-cluster Gateway VIP (10.73.0.24x);"
+                            echo "FAIL: $host did not resolve to the in-cluster Gateway VIP (192.168.1.53-.60);"
                             echo "      split-horizon coredns-custom not in effect (got a public/off-cluster answer)."
                             exit 1
         - assert: