diff --git a/ap/50-van-wan.yaml b/ap/50-van-wan.yaml
index 121b006..b660805 100644
--- a/ap/50-van-wan.yaml
+++ b/ap/50-van-wan.yaml
@@ -25,6 +25,14 @@ network:
       renderer: NetworkManager
       optional: true
       dhcp4: true
+      # IPv6 is deliberate as of 2026-07-12: NM does SLAAC/DHCPv6 itself.
+      # Before this it only worked by accident — dracut's runtime catch-all
+      # /run/systemd/network/zzzz-dracut-default.network had networkd
+      # co-managing wlan0 (second DHCPv4 client + surprise IPv6); deploy.sh
+      # now masks that file. Privacy (temporary) addresses stay off so hbd
+      # and DNS see one stable source address per uplink.
+      dhcp6: true
+      ipv6-privacy: false
       access-points:
         "Wapana":
           auth:
diff --git a/deploy.sh b/deploy.sh
index 68a096b..faa82f1 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -27,6 +27,12 @@ install -D -m0644 ap/21-van-br0.network     /etc/systemd/network/21-van-br0.netw
 install -D -m0644 ap/22-van-lan.network     /etc/systemd/network/22-van-lan.network
 install -D -m0644 ap/23-van-lan-eth0.network /etc/systemd/network/23-van-lan-eth0.network
 install -D -m0644 ap/van-ap-unmanaged.conf  /etc/NetworkManager/conf.d/van-ap-unmanaged.conf
+# Mask dracut's initramfs-generated catch-all (/run/systemd/network/
+# zzzz-dracut-default.network, regenerated every boot): it matches every
+# unconfigured link, so networkd co-managed the NM-owned WANs — a second
+# DHCPv4 client on wlan0 and IPv6 that worked only by accident. NM owns WAN
+# IPv6 now (see ap/50-van-wan.yaml). /etc overrides /run; /dev/null masks.
+ln -sfn /dev/null /etc/systemd/network/zzzz-dracut-default.network
 install -D -m0644 ap/nftables.conf          /etc/nftables.conf
 install -D -m0644 ap/regdomain.service      /etc/systemd/system/regdomain.service
 install -D -m0644 ap/rtw89.conf             /etc/modprobe.d/rtw89.conf