diff --git a/hosts/docker/host.nix b/hosts/docker/host.nix
index 4f9fda4..fb684f4 100644
--- a/hosts/docker/host.nix
+++ b/hosts/docker/host.nix
@@ -14,6 +14,11 @@
   };
   boot.zfs.forceImportRoot = false;
 
+  # Only advertise the LAN interface to IPA DNS. Without this, SSSD registers
+  # every Docker bridge (172.x.x.x) as an A record for docker.sweet.home —
+  # the default dyndns.interface = "*" catches them all.
+  security.ipa.dyndns.interface = vars.lxcLanInterface; # eth0
+
   # Preserved from the pre-refactor `docker` target — stateVersion must never
   # be bumped on an already-installed machine.
   system.stateVersion = "25.05";