diff --git a/clusters/base/cluster-vars.yaml b/clusters/base/cluster-vars.yaml
index 5508c31..b2f0bf9 100644
--- a/clusters/base/cluster-vars.yaml
+++ b/clusters/base/cluster-vars.yaml
@@ -21,6 +21,13 @@ data:
   DNS_ZONE: "keithjackson.dev"              # the actual Cloudflare ZONE (BASE_DOMAIN is a subdomain of it);
                                             # ExternalDNS domain-filter must be the zone, not the subdomain
   ACME_CLUSTER_ISSUER: "letsencrypt-staging" # dev: staging | prod: letsencrypt-prod (ADR-0006)
+  GATEWAY_VIP: "10.73.0.240"                 # in-cluster split-horizon target (R-DNS-01/03): the L2-announced
+                                            # ingress VIP of the `shared` Gateway (first IP of the Cilium
+                                            # LB IP pool 10.73.0.240-.250, platform-config/cilium/l2-ip-pool.yaml).
+                                            # coredns-custom answers *.home.keithjackson.dev with THIS so pod->
+                                            # public-hostname traffic hairpins through the Gateway (correct SNI ->
+                                            # wildcard cert). Base default = dev VIP; a prod overlay must set the
+                                            # prod LAN VIP alongside the prod L2 pool range when hardware is built.
 
   # --- storage (ADR-0003) ---
   LONGHORN_DEFAULT_REPLICA_COUNT: "3"       # default StorageClass replica count (3 on 3 nodes)
diff --git a/clusters/prod/kustomization.yaml b/clusters/prod/kustomization.yaml
index b0de8e9..c0902bd 100644
--- a/clusters/prod/kustomization.yaml
+++ b/clusters/prod/kustomization.yaml
@@ -45,3 +45,7 @@ patches:
         path: /data/VELERO_RETENTION
         value: "720h"
       # TODO(WS-INFRA, Phase 7): pin prod node placement once the bare-metal role labels exist.
+      # TODO(WS-NET, Phase 7): set GATEWAY_VIP to the prod LAN ingress VIP (add a `replace` op here)
+      #   at the same time the prod Cilium LB IP pool range is supplied — the split-horizon
+      #   coredns-custom (platform/coredns) answers *.home.keithjackson.dev with ${GATEWAY_VIP}, so
+      #   the prod value must match the prod pool's Gateway address. Base default is the dev VIP.