diff --git a/k8s/apps/agent-pod/deployment.yaml b/k8s/apps/agent-pod/deployment.yaml
index 51edd75..9cb0f05 100644
--- a/k8s/apps/agent-pod/deployment.yaml
+++ b/k8s/apps/agent-pod/deployment.yaml
@@ -13,6 +13,14 @@ spec:
       labels:
         app: agent-pod
     spec:
+      # api.riotpiao.com has no in-cluster DNS record (only resolves from the
+      # home network's own resolver) -- pin it to ingress-nginx-controller's
+      # ClusterIP so pi's models.json baseUrl works unchanged. TLS still
+      # terminates correctly since SNI/Host still say api.riotpiao.com.
+      hostAliases:
+        - ip: "10.101.128.185"
+          hostnames:
+            - "api.riotpiao.com"
       containers:
         - name: pi
           image: node:22-slim