diff --git a/terraform/files/cilium/l2-announcement.yaml b/terraform/files/cilium/l2-announcement.yaml
index a3ba764..3e95db6 100644
--- a/terraform/files/cilium/l2-announcement.yaml
+++ b/terraform/files/cilium/l2-announcement.yaml
@@ -11,3 +11,10 @@ spec:
   loadBalancerIPs: true
   interfaces:
     - eno1
+  # Only control-plane nodes may hold the L2 lease. They have the `eno1` LAN NIC;
+  # the GPU worker's NICs are enp28s0f*np* (Mellanox) with NO eno1 — if it won the
+  # lease it held the LB VIP but couldn't ARP it, turning .160 into a LAN black
+  # hole (cluster-wide outage that flapped as reboots reshuffled the lease).
+  nodeSelector:
+    matchLabels:
+      node-role.kubernetes.io/control-plane: ""