diff --git a/ap/nftables.conf b/ap/nftables.conf
index 91ee99f..4ef329c 100755
--- a/ap/nftables.conf
+++ b/ap/nftables.conf
@@ -4,8 +4,20 @@
 table ip van_router_nat
 delete table ip van_router_nat
 table ip van_router_nat {
+    chain prerouting {
+        type nat hook prerouting priority dstnat; policy accept;
+        # Home Assistant VM (ha_van) is bridged onto br0 at 10.42.0.50 — clients reach
+        # it directly. Keep the legacy http://10.42.0.1:8123 URL working for anything
+        # that bookmarked it (phones, ZT clients).
+        ip daddr 10.42.0.1 tcp dport 8123 dnat to 10.42.0.50:8123
+    }
     chain postrouting {
         type nat hook postrouting priority srcnat; policy accept;
         ip saddr 10.42.0.0/24 oifname != "br0" masquerade
+        # Hairpin for the legacy 10.42.0.1:8123 DNAT when the client sits on the same
+        # subnet as the HA VM: without masquerade the VM would reply directly on br0
+        # from 10.42.0.50 and the client (expecting 10.42.0.1) would drop it. ZT-sourced
+        # traffic doesn't match and doesn't need it — VM replies route back through us.
+        ip saddr 10.42.0.0/24 ip daddr 10.42.0.50 tcp dport 8123 oifname "br0" masquerade
     }
 }
diff --git a/ap/van-ap-dnsmasq.conf b/ap/van-ap-dnsmasq.conf
index 1639585..21dc0ce 100644
--- a/ap/van-ap-dnsmasq.conf
+++ b/ap/van-ap-dnsmasq.conf
@@ -5,5 +5,8 @@ domain-needed
 bogus-priv
 dhcp-authoritative
 dhcp-range=10.42.0.10,10.42.0.254,255.255.255.0,12h
+# Home Assistant VM (libvirt ha_van, bridged onto br0) — pinned address, resolves
+# as "homeassistant" via this dnsmasq; HAOS also announces homeassistant.local (mDNS).
+dhcp-host=52:54:00:ad:0a:01,10.42.0.50,homeassistant
 dhcp-option=option:router,10.42.0.1
 dhcp-option=option:dns-server,10.42.0.1
diff --git a/ha/ha_van.xml b/ha/ha_van.xml
new file mode 100644
index 0000000..948ab45
--- /dev/null
+++ b/ha/ha_van.xml
@@ -0,0 +1,53 @@
+<!-- Home Assistant OS VM — aarch64 port for the Pi 4 "wan" host.
+     Same identity as wayback's x86 ha_van: MAC 52:54:00:ad:0a:01 is pinned to
+     10.42.0.50/"homeassistant" by van-ap-dnsmasq. 2 GiB RAM (Pi has 3.7 total),
+     machine=virt + AAVMF EFI, virtio disk/net. Data migrated via HA full backup
+     (x86 qcow2 can't move across architectures). -->
+<domain type='kvm'>
+  <name>ha_van</name>
+  <uuid>af014c94-de20-4f52-8d6b-438f16cd82e6</uuid>
+  <description>Home Assistant OS (aarch64)</description>
+  <memory unit='KiB'>2097152</memory>
+  <currentMemory unit='KiB'>2097152</currentMemory>
+  <vcpu placement='static'>2</vcpu>
+  <os firmware='efi'>
+    <type arch='aarch64' machine='virt'>hvm</type>
+    <firmware>
+      <feature enabled='no' name='enrolled-keys'/>
+      <feature enabled='no' name='secure-boot'/>
+    </firmware>
+    <boot dev='hd'/>
+  </os>
+  <features>
+    <gic version='2'/>
+  </features>
+  <cpu mode='host-passthrough' check='none'/>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-aarch64</emulator>
+    <disk type='file' device='disk'>
+      <driver name='qemu' type='qcow2' discard='unmap'/>
+      <source file='/var/lib/libvirt/images/haos_generic-aarch64-18.1.qcow2'/>
+      <target dev='sda' bus='scsi'/>
+    </disk>
+    <controller type='scsi' index='0' model='virtio-scsi'/>
+    <interface type='bridge'>
+      <mac address='52:54:00:ad:0a:01'/>
+      <source bridge='br0'/>
+      <model type='virtio'/>
+    </interface>
+    <serial type='pty'>
+      <target type='system-serial' port='0'/>
+    </serial>
+    <console type='pty'>
+      <target type='serial' port='0'/>
+    </console>
+    <rng model='virtio'>
+      <backend model='random'>/dev/urandom</backend>
+    </rng>
+    <memballoon model='virtio'/>
+  </devices>
+</domain>