diff --git a/hosts/xlab-gateway/dhcp.nix b/hosts/xlab-gateway/dhcp.nix
index b92c4b8..32124f0 100644
--- a/hosts/xlab-gateway/dhcp.nix
+++ b/hosts/xlab-gateway/dhcp.nix
@@ -46,6 +46,10 @@
           test = "substring(option[60].hex,0,8) == 'Cisco AP'";
           option-data = [
             { name = "vendor-encapsulated-options"; csv-format = false; data = "F1:04:0A:00:0A:0A"; always-send = true; }
+            # CAPWAP over the 1420-MTU wg-to-wgnet tunnel: the AP sends 1441B DF
+            # DTLS packets and ignores PMTUD frag-needed, so the join blackholes.
+            # Pin the AP's wired MTU to 1420 so it never exceeds the path.
+            { name = "interface-mtu"; data = "1420"; always-send = true; }
           ];
         }
       ];