diff --git a/k8s-ng/core/traefik-config/helmchartconfig.yaml b/k8s-ng/core/traefik-config/helmchartconfig.yaml
index 3d01157..99cf248 100644
--- a/k8s-ng/core/traefik-config/helmchartconfig.yaml
+++ b/k8s-ng/core/traefik-config/helmchartconfig.yaml
@@ -16,6 +16,10 @@ spec:
     service:
       spec:
         externalTrafficPolicy: Local
+        # ServiceLB masquerades clients as pod traffic before the NodePort hop,
+        # which bypasses externalTrafficPolicy. Prefer the ingress on this node
+        # for that cluster-policy path as well.
+        trafficDistribution: PreferSameNode
     tolerations:
       - key: workload
         operator: Equal