diff --git a/smart-home/docker-compose.yml b/smart-home/docker-compose.yml
index f3b80e4..8e47ba9 100644
--- a/smart-home/docker-compose.yml
+++ b/smart-home/docker-compose.yml
@@ -31,7 +31,7 @@ services:
       # Temporary onboarding guard: keep HA reachable only from LAN/Tailscale
       # until the owner account exists.
       - traefik.http.routers.homeassistant.middlewares=homeassistant-lan-only
-      - traefik.http.middlewares.homeassistant-lan-only.ipallowlist.sourcerange=192.168.178.0/24,100.64.0.0/10
+      - traefik.http.middlewares.homeassistant-lan-only.ipallowlist.sourcerange=192.168.178.0/24,100.64.0.0/10,217.249.114.123/32
       - traefik.http.services.homeassistant.loadbalancer.server.port=8123
 
   mosquitto: