diff --git a/hosts/12kingdoms-youko/vpn.nix b/hosts/12kingdoms-youko/vpn.nix
index 153c19ff..747f5519 100644
--- a/hosts/12kingdoms-youko/vpn.nix
+++ b/hosts/12kingdoms-youko/vpn.nix
@@ -1,4 +1,11 @@
-{ pkgs, ... }:
+{
+  pkgs,
+  myvars,
+  ...
+}:
+let
+  inherit (myvars.networking) hostsAddr k8sVip;
+in
 {
   environment.systemPackages = [ pkgs.tailscale ];
 
@@ -11,8 +18,10 @@
 
     useRoutingFeatures = "server";
     extraSetFlags = [
-      # advertise homelab subnet via tailscale
-      "--advertise-routes=192.168.5.0/24"
+      # Advertise only youko itself and the k8s VIP block, not the whole /24:
+      # a /24 route would shadow hosts that are already reachable directly
+      # (e.g. idols-ai at 192.168.5.100).
+      "--advertise-routes=${hostsAddr.youko.ipv4}/32,${k8sVip.cidr}"
       "--accept-routes=false"
     ];
   };
diff --git a/vars/networking.nix b/vars/networking.nix
index 667af484..3ef578ae 100644
--- a/vars/networking.nix
+++ b/vars/networking.nix
@@ -18,6 +18,23 @@ rec {
   ];
   prefixLength = 24;
 
+  # Dedicated VIP block for the k3s clusters, outside the router's DHCP pool
+  # (.2-.99). One /29 per cluster, handed to kube-vip: the first usable address
+  # is the control-plane API VIP, the rest are LoadBalancer service VIPs.
+  k8sVip = {
+    cidr = "192.168.5.192/27";
+    clusters = {
+      k3s-test-1 = {
+        cidr = "192.168.5.192/29";
+        apiVip = "192.168.5.193";
+      };
+      # Reserved for future clusters:
+      #   .200/29  apiVip .201
+      #   .208/29  apiVip .209
+      #   .216/29  apiVip .217
+    };
+  };
+
   hostsAddr = {
     # ============================================
     # Homelab's Physical Machines (VM hosts)