diff --git a/modules/docker/mount-data.nix b/modules/docker/mount-data.nix
index 267deae..1214edd 100644
--- a/modules/docker/mount-data.nix
+++ b/modules/docker/mount-data.nix
@@ -10,24 +10,19 @@ let
   # non-blocking behavior, so they don't need `nofail` too).
   automountOpts = if config.boot.isContainer then [ "nofail" ] else [ "x-systemd.automount" ];
 
-  # A bare hostname here never resolves reliably: systemd-resolved only
-  # ever tries LLMNR for single-label names (never DNS, regardless of any
-  # configured search domain), and a *global* search domain (the first fix
-  # attempted here) backfires worse -- confirmed live on lxc-docker, adding
-  # `networking.search` made systemd-resolved prioritize its domain-matched
-  # but server-less global scope over eth0's correctly-configured one for
-  # every "*.sweet.home" query, silently sending them to public fallback
-  # DNS instead. `resolvectl query --interface=eth0 server.sweet.home`
-  # resolved fine throughout, proving the LAN DNS server was never the
-  # problem -- only the ambient, unqualified device string was. Using the
-  # FQDN directly sidesteps all of that, matching the pattern
-  # ../raspi/mount-data.nix already uses for the same reason.
-  nfsServer = "${vars.nfsServerHost}.${vars.homeDomain}";
+  # FQDN in the storage.home zone — resolves to the Pacemaker vip-storage
+  # (192.168.20.229) on docker's eth1/vmbr2 interface. Using the DNS name
+  # rather than the raw IP means a future VIP renumber only requires a DNS
+  # update, not a NixOS rebuild. The storage.home zone is served by the same
+  # FreeIPA nameserver (domainControllerIp) that docker already uses, so
+  # resolution reaches it over eth0 without any extra routing.
+  nfsServer = vars.haStorageNfsFqdn;
+  storageRoot = vars.haStorageRoot;
 in
 {
   fileSystems = {
     ${vars.nfsShares.dockerConfig.mountpoint} = {
-      device = "${nfsServer}:${vars.storageRoot}/${vars.nfsShares.dockerConfig.subpath}";
+      device = "${nfsServer}:${storageRoot}/${vars.nfsShares.dockerConfig.subpath}";
       fsType = "nfs";
 
       options = [
@@ -38,7 +33,7 @@ in
     };
 
     ${vars.nfsShares.dockerDatabases.mountpoint} = {
-      device = "${nfsServer}:${vars.storageRoot}/${vars.nfsShares.dockerDatabases.subpath}";
+      device = "${nfsServer}:${storageRoot}/${vars.nfsShares.dockerDatabases.subpath}";
       fsType = "nfs";
 
       options = [
@@ -49,7 +44,7 @@ in
     };
 
     ${vars.nfsShares.dockerVolumes.mountpoint} = {
-      device = "${nfsServer}:${vars.storageRoot}/${vars.nfsShares.dockerVolumes.subpath}";
+      device = "${nfsServer}:${storageRoot}/${vars.nfsShares.dockerVolumes.subpath}";
       fsType = "nfs";
 
       options = [
@@ -60,7 +55,7 @@ in
     };
 
     ${vars.nfsShares.nextcloudData.mountpoint} = {
-      device = "${nfsServer}:${vars.storageRoot}/${vars.nfsShares.nextcloudData.subpath}";
+      device = "${nfsServer}:${storageRoot}/${vars.nfsShares.nextcloudData.subpath}";
       fsType = "nfs";
 
       options = [
@@ -71,7 +66,7 @@ in
     };
 
     ${vars.nfsShares.raspiVolumes.mountpoint} = {
-      device = "${nfsServer}:${vars.storageRoot}/${vars.nfsShares.raspiVolumes.subpath}";
+      device = "${nfsServer}:${storageRoot}/${vars.nfsShares.raspiVolumes.subpath}";
       fsType = "nfs";
 
       options = [
diff --git a/variables.nix b/variables.nix
index 1a4f328..4feb863 100644
--- a/variables.nix
+++ b/variables.nix
@@ -128,6 +128,7 @@
   haClientCidr = "192.168.20.0/24"; # storage-client subnet — VLAN 20, internal to pve1 only
   haClientPrefixLength = 24; # storage-client subnet prefix length (/24)
   haStorageRoot = "/srv/ha-data"; # XFS-over-DRBD mount point on the Active node
+  haStorageNfsFqdn = "nfs.storage.home"; # NFS VIP FQDN (storage.home zone) — resolves to haServerVip; use this in fileSystems device strings
   haIscsiIqn = "iqn.2026-01.home.sweet:ha-storage";
   # DRBD backing disk — identified by SCSI controller path so it resolves to the
   # correct block device regardless of OS-level naming (sda vs sdb can differ