diff --git a/hosts/skydick/default.nix b/hosts/skydick/default.nix
index 785ff48..96cf967 100644
--- a/hosts/skydick/default.nix
+++ b/hosts/skydick/default.nix
@@ -92,6 +92,10 @@
     };
     nameservers = [ "10.0.0.1" "223.5.5.5" ];
 
+    # Prefer IPv4 for outbound connections — IPv6 goes through wg-outbound
+    # on 10.0.0.1 which masquerades with ULA (not globally routable)
+    enableIPv6 = false;
+
     firewall = {
       enable = true;
       allowedTCPPorts = [