diff --git a/CLAUDE.md b/CLAUDE.md
index da9ac4bf..020a74b6 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -113,8 +113,7 @@ the insecure package, the assertion fails and prompts removal.
 
 **Home router:** Vodafone Station Arris CGA6444VF (`192.168.0.1`). WAN IP:
 `91.64.99.245`. No NAT hairpin. DHCP is disabled (pi handles it). Ports 80/443
-are port-forwarded to tower (`.10`). The router **blocks LAN→LAN traffic on
-port-forwarded ports** — WiFi clients cannot reach tower:80/443 directly.
+are port-forwarded to tower (`.10`).
 
 **LAN DHCP + DNS:** served by `pi` via `dnsmasq` (`modules/lan-dns.nix`,
 listening on `end0`, static `.18`). Pi auto-upgrades from main nightly — test
@@ -125,9 +124,6 @@ before merging.
 `modules/hosts/tower/configuration.nix` — not a pi DHCP reservation). Tower's NM
 profile uses pi (`.18`) for DNS so split-horizon resolution works on tower too.
 
-**Split-horizon DNS targets:** `test/creatures/files/adele.etiennerobert.com`.
-Dnsmasq overrides these to **`192.168.0.10` (tower)**.
-
 **Testing the public/external path:** LAN clients resolve these names to tower
 directly (split-horizon) and bypass the port-forward, so they can't exercise the
 real external path. To test as an outside visitor would (public DNS →
diff --git a/modules/hosts/tower/configuration.nix b/modules/hosts/tower/configuration.nix
index 27423212..49572166 100644
--- a/modules/hosts/tower/configuration.nix
+++ b/modules/hosts/tower/configuration.nix
@@ -39,6 +39,14 @@
       ipv4 = {
         method = "manual";
         address1 = "192.168.0.10/24,192.168.0.1";
+
+        # Second address for LAN clients (published by pi's split-horizon
+        # DNS): the Vodafone Station drops LAN-side traffic from WiFi clients
+        # to .10 on the port-forwarded ports (80/443), but the filter is keyed
+        # to the forward's target IP, so the same services on .11 pass. Keep
+        # the port forwards themselves pointing at .10.
+        address2 = "192.168.0.11/24";
+
         dns = "192.168.0.18;";
       };
     };
diff --git a/modules/lan-dns.nix b/modules/lan-dns.nix
index b12eb43f..b3e45dce 100644
--- a/modules/lan-dns.nix
+++ b/modules/lan-dns.nix
@@ -22,15 +22,19 @@ _: {
               "1.1.1.1"
               "9.9.9.9"
             ];
-            host-record = [
-              "test.etiennerobert.com,192.168.0.10"
-              "creatures.etiennerobert.com,192.168.0.10"
-              "files.etiennerobert.com,192.168.0.10"
-              "adele.etiennerobert.com,192.168.0.10"
-              "umami.etiennerobert.com,192.168.0.10"
-              "images.etiennerobert.com,192.168.0.10"
-              "rift.etiennerobert.com,192.168.0.10"
-              "rack.etiennerobert.com,192.168.0.10"
+            # .11 is tower's second address, required for WiFi clients: the
+            # Vodafone Station drops LAN-side traffic from its WLAN to the
+            # port-forward target (.10) on the forwarded ports (80/443), but
+            # the filter is keyed to that target IP, so .11 passes.
+            host-record = map (name: "${name}.etiennerobert.com,192.168.0.11") [
+              "test"
+              "creatures"
+              "files"
+              "adele"
+              "umami"
+              "images"
+              "rift"
+              "rack"
             ];
             dhcp-range = "192.168.0.50,192.168.0.250,12h";
             dhcp-option = [ "option:router,192.168.0.1" ];