diff --git a/services/pelican.nix b/services/pelican.nix
index aa516c2..6e26175 100644
--- a/services/pelican.nix
+++ b/services/pelican.nix
@@ -89,7 +89,16 @@
         TRUSTED_PROXIES = "172.16.0.0/12,10.0.0.0/8,127.0.0.1/32";
         TZ = "Europe/Stockholm";
       };
-      extraOptions = [ "--add-host=host.docker.internal:host-gateway" ];
+      extraOptions = [
+        "--add-host=host.docker.internal:host-gateway"
+        # The panel calls the node over its public FQDN. Without this the
+        # container's DNS answers with the WAN address and the request
+        # hairpins out through the router and back into the same box — which
+        # works, but breaks whenever the WAN link flaps even though both ends
+        # are local. Pin it to the LAN IP; nginx serves a wildcard cert so
+        # SNI still matches.
+        "--add-host=games.nordhammer.it:10.0.0.1"
+      ];
     };
 
     virtualisation.oci-containers.containers.pelican-wings = {