diff --git a/homeassistant/homeassistant.yaml b/homeassistant/homeassistant.yaml
index 78e5fdd..639c271 100644
--- a/homeassistant/homeassistant.yaml
+++ b/homeassistant/homeassistant.yaml
@@ -32,7 +32,9 @@ data:
     http:
       use_x_forwarded_for: true
       trusted_proxies:
-        - 10.88.88.0/24
+        - 10.42.0.0/16   # k3s pod CIDR (Traefik pod lives here)
+        - 10.43.0.0/16   # k3s service CIDR
+        - 10.88.20.0/24  # node subnet (Traefik runs hostNetwork-ish, forwards from 10.88.20.11)
 ---
 apiVersion: apps/v1
 kind: Deployment