diff --git a/k8s/apps/firefly-iii/kustomization.yaml b/k8s/apps/firefly-iii/kustomization.yaml
index d36f7cc..a1411d8 100644
--- a/k8s/apps/firefly-iii/kustomization.yaml
+++ b/k8s/apps/firefly-iii/kustomization.yaml
@@ -70,3 +70,11 @@ patches:
       - op: add
         path: /metadata/labels/firefly.hexor.cy~1private-ai
         value: "true"
+      # The shared Traefik has the same controller identifier and can discover
+      # IngressClass objects. The explicit annotation partitions this Ingress
+      # so only the instance configured with ingressclass=traefik-ai accepts it.
+      - op: add
+        path: /metadata/annotations/kubernetes.io~1ingress.class
+        value: traefik-ai
+      - op: remove
+        path: /spec/ingressClassName
diff --git a/k8s/apps/firefly-iii/traefik-ai.yaml b/k8s/apps/firefly-iii/traefik-ai.yaml
index a9bfc1a..19a7618 100644
--- a/k8s/apps/firefly-iii/traefik-ai.yaml
+++ b/k8s/apps/firefly-iii/traefik-ai.yaml
@@ -138,6 +138,7 @@ spec:
             - name: web
               containerPort: 8000
               hostPort: 80
+              hostIP: 192.168.1.117
               protocol: TCP
           readinessProbe:
             tcpSocket: