diff --git a/k8s/apps/firefly-iii/network-policy.yaml b/k8s/apps/firefly-iii/network-policy.yaml
index 868279a..bda45f0 100644
--- a/k8s/apps/firefly-iii/network-policy.yaml
+++ b/k8s/apps/firefly-iii/network-policy.yaml
@@ -19,6 +19,11 @@ spec:
             matchLabels:
               app.kubernetes.io/instance: firefly-iii
               app.kubernetes.io/name: firefly-iii
+        # hostNetwork traffic is seen as node traffic rather than Pod traffic.
+        - ipBlock:
+            cidr: 192.168.1.117/32
+        - ipBlock:
+            cidr: 100.77.155.120/32
       ports:
         - protocol: TCP
           port: 8080
@@ -56,4 +61,3 @@ spec:
       ports:
         - protocol: TCP
           port: 8000
-
diff --git a/k8s/apps/firefly-iii/traefik-ai.yaml b/k8s/apps/firefly-iii/traefik-ai.yaml
index 19a7618..7924289 100644
--- a/k8s/apps/firefly-iii/traefik-ai.yaml
+++ b/k8s/apps/firefly-iii/traefik-ai.yaml
@@ -114,6 +114,8 @@ spec:
         app.kubernetes.io/name: traefik-ai
     spec:
       serviceAccountName: traefik-ai
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
       nodeSelector:
         kubernetes.io/hostname: ai.tail2fe2d.ts.net
       tolerations:
@@ -126,7 +128,7 @@ spec:
           image: rancher/mirrored-library-traefik:3.6.13
           imagePullPolicy: IfNotPresent
           args:
-            - --entrypoints.web.address=:8000
+            - --entrypoints.web.address=192.168.1.117:80
             - --providers.kubernetesingress=true
             - --providers.kubernetesingress.namespaces=firefly-iii
             - --providers.kubernetesingress.ingressclass=traefik-ai
@@ -136,7 +138,7 @@ spec:
             - --log.level=INFO
           ports:
             - name: web
-              containerPort: 8000
+              containerPort: 80
               hostPort: 80
               hostIP: 192.168.1.117
               protocol: TCP
@@ -160,6 +162,8 @@ spec:
             capabilities:
               drop:
                 - ALL
+              add:
+                - NET_BIND_SERVICE
             readOnlyRootFilesystem: true
             runAsNonRoot: true
             runAsUser: 65532