diff --git a/kubernetes/infrastructure/cilium/helmrelease.yaml b/kubernetes/infrastructure/cilium/helmrelease.yaml
index 7d5febbf..0cab3b5f 100644
--- a/kubernetes/infrastructure/cilium/helmrelease.yaml
+++ b/kubernetes/infrastructure/cilium/helmrelease.yaml
@@ -140,3 +140,28 @@ spec:
       enabled: true
     externalIPs:
       enabled: true
+    # BGP to the UDM. The peering itself has always been in git as CRDs in
+    # post-crds/cilium-bgp.yaml — but the switch that starts the control plane
+    # was not, and neither were the CIDRs below. They were applied by hand and
+    # held by the `kubectl-patch` field manager on cilium-config. Server-side
+    # apply left them alone, so nothing broke and nothing noticed; a cold
+    # rebuild would have come up with BGP off while the CRDs said otherwise.
+    #
+    # This is not a free change of ownership. Enabling bgpControlPlane through
+    # the chart also emits companion keys the hand-patch never set —
+    # bgp-secrets-namespace, bgp-router-id-allocation-mode and -ip-pool,
+    # enable-bgp-control-plane-status-report, enable-bgp-legacy-origin-attribute
+    # — so Cilium has been running on its own defaults for those. Router-id
+    # allocation is the one to watch: if the chart's default disagrees with
+    # Cilium's, the sessions re-establish.
+    bgpControlPlane:
+      enabled: true
+    # Masquerading exception, not a routing statement: pod traffic to these
+    # ranges leaves unmasqueraded, so LAN services see real pod IPs. That only
+    # works because BGP advertises the pod CIDRs, which is what gives the UDM a
+    # route back. The two settings are one decision and have to move together.
+    #
+    # Pod CIDRs are 10.244.0.0/16 and fd10:244::/48 (talos/patches/cluster.yaml);
+    # the supernets here cover the LAN as well, which is the point.
+    ipv4NativeRoutingCIDR: 10.0.0.0/8
+    ipv6NativeRoutingCIDR: fd00::/8