diff --git a/hosts/skydick/default.nix b/hosts/skydick/default.nix
index 9745885..fb3688f 100644
--- a/hosts/skydick/default.nix
+++ b/hosts/skydick/default.nix
@@ -117,7 +117,11 @@
   systemd.network.networks."40-bond40g" = {
     networkConfig = {
       IPv6AcceptRA = true;
-      IPv6PrivacyExtensions = false;
+      # NixOS unconditionally sets IPv6PrivacyExtensions = "kernel" (normal
+      # priority) for every interface in networking.interfaces, so mkForce is
+      # required to disable privacy extensions and pin the stable ::d1c0 token
+      # address as the source — a plain `false` collides with that default.
+      IPv6PrivacyExtensions = lib.mkForce false;
     };
     ipv6AcceptRAConfig = {
       Token = "::d1c0";