diff --git a/infra/ansible/inventory/hosts.ini b/infra/ansible/inventory/hosts.ini
index 7503991..b83691d 100644
--- a/infra/ansible/inventory/hosts.ini
+++ b/infra/ansible/inventory/hosts.ini
@@ -1,16 +1,23 @@
-# Static inventory — ALIGNED with infra/tofu defaults (LOCKED PHASE1-SCOPE IPs).
+# Static inventory — ALIGNED with infra/tofu defaults (Proxmox migration IPs).
 # Regenerate from tofu when IPs/names are overridden:
 #   cd ../tofu && tofu output -raw ansible_inventory > ../ansible/inventory/hosts.ini
 #
 # k3s_primary = the --cluster-init server (embedded-etcd founder + Cilium k8sServiceHost).
 # k3s_secondary = the two servers that join it. All three are servers (HA embedded etcd).
+#
+# NAT HAND-OFF (PM to finalize): the nodes now live on the Proxmox LAN at
+# 192.168.1.50/.51/.52. The PM reaches them over a pfSense NAT that is NOT yet created.
+# Once the NAT/port-forward rule exists, the `ansible_host` (and possibly
+# `ansible_port`) below may need to be the NAT-forwarded address:port instead of the
+# raw node IP — do NOT guess it here. If the control node has direct LAN reachability
+# to 192.168.1.0/24, the raw IPs below are correct as-is.
 
 [k3s_primary]
-k3s-dev-1 ansible_host=10.73.0.11
+k3s-dev-1 ansible_host=192.168.1.50
 
 [k3s_secondary]
-k3s-dev-2 ansible_host=10.73.0.12
-k3s-dev-3 ansible_host=10.73.0.13
+k3s-dev-2 ansible_host=192.168.1.51
+k3s-dev-3 ansible_host=192.168.1.52
 
 [k3s_servers:children]
 k3s_primary
diff --git a/platform-config/cilium/l2-announcement-policy.yaml b/platform-config/cilium/l2-announcement-policy.yaml
index 506729f..ca3dd82 100644
--- a/platform-config/cilium/l2-announcement-policy.yaml
+++ b/platform-config/cilium/l2-announcement-policy.yaml
@@ -1,8 +1,10 @@
 ---
 # CiliumL2AnnouncementPolicy — ARP-announce LoadBalancer VIPs on the node LAN so hosts on
-# 10.73.0.0/24 can reach Gateway listeners at the pool IP (l2announcements.enabled=true in the
+# 192.168.1.0/24 can reach Gateway listeners at the pool IP (l2announcements.enabled=true in the
 # Cilium HelmRelease turns on the controller; this policy scopes WHAT/WHERE it announces).
-# Announces on the primary ethernet interface (cloud-init names it ens3; `^en` matches ens*/enp*).
+# Announces on the primary ethernet interface. On Proxmox VMs the NIC is typically ens18/eth0;
+# `^e(n|th)` matches ens*/enp*/eth* so the exact name need not be pinned. VERIFY-AT-BRINGUP: if
+# announcement fails, confirm the node's primary NIC name (`ip -o link`) matches this selector.
 apiVersion: cilium.io/v2alpha1
 kind: CiliumL2AnnouncementPolicy
 metadata:
@@ -11,7 +13,7 @@ spec:
   loadBalancerIPs: true       # announce LoadBalancer Service VIPs (Gateway listeners)
   externalIPs: false
   interfaces:
-    - ^en
+    - ^e(n|th)
   nodeSelector:
     matchLabels:
       kubernetes.io/os: linux
diff --git a/platform-config/cilium/l2-ip-pool.yaml b/platform-config/cilium/l2-ip-pool.yaml
index 826029c..4255803 100644
--- a/platform-config/cilium/l2-ip-pool.yaml
+++ b/platform-config/cilium/l2-ip-pool.yaml
@@ -1,10 +1,10 @@
 ---
 # CiliumLoadBalancerIPPool — reserved VIP range for LoadBalancer Services. Gateway API listeners
 # (gatewayClassName: cilium) get their address from here. Range matches the tofu reservation
-# (cilium_l2_vip_range 10.73.0.240-.250) on the k3s-dev NAT 10.73.0.0/24; DHCP is OFF on that
-# network so the range can never be leased elsewhere.
+# (cilium_l2_vip_range 192.168.1.53-.60) on the Proxmox LAN 192.168.1.0/24. These addresses sit
+# OUTSIDE the node IPs (.50/.51/.52) and any DHCP scope, so nothing else claims them.
 #
-# NOTE (dev): the range is hardcoded to the dev NAT reservation. A prod overlay must supply the
+# NOTE (dev): the range is hardcoded to the dev LAN reservation. A prod overlay must supply the
 # prod LAN range (parameterize via cluster-vars when prod hardware is built). See DECISIONS-LOG.
 apiVersion: cilium.io/v2alpha1
 kind: CiliumLoadBalancerIPPool
@@ -12,5 +12,5 @@ metadata:
   name: default-pool
 spec:
   blocks:
-    - start: "10.73.0.240"
-      stop: "10.73.0.250"
+    - start: "192.168.1.53"
+      stop: "192.168.1.60"