diff --git a/services/router.nix b/services/router.nix
index fc9ee2c..2973b02 100644
--- a/services/router.nix
+++ b/services/router.nix
@@ -153,7 +153,8 @@ in
             # Container bridges reaching host services (e.g. Profilarr → Radarr
             # on 10.0.0.1:7878, Forgejo runner → AdGuard DNS). br-* covers
             # Docker user-defined networks, podman* covers Podman (rootful).
-            iifname { "docker0", "br-*", "podman*" } accept
+            # pelican0 is wings' own bridge (config.yml names it), so br-* misses it.
+            iifname { "docker0", "br-*", "podman*", "pelican0" } accept
             # Phase 1: also trust the existing eero subnet on eno1 so SSH
             # and AdGuard DNS keep working during the transition.
             ${legacyTrustRules}
@@ -173,7 +174,8 @@ in
             iifname "eth0" accept
             # Containers → anywhere (image pulls, Forgejo runner workflows,
             # etc.). br-* = Docker custom networks, podman* = Podman rootful.
-            iifname { "docker0", "br-*", "podman*" } accept
+            # pelican0 = wings' bridge; it does not match br-*.
+            iifname { "docker0", "br-*", "podman*", "pelican0" } accept
             # WAN → any port-forward target (LAN host or docker container)
             iifname "eno1" ct status dnat accept
           }