diff --git a/ansible/host_vars/gpu-node.yaml b/ansible/host_vars/gpu-node.yaml
index 2c8b52f..25e72bd 100644
--- a/ansible/host_vars/gpu-node.yaml
+++ b/ansible/host_vars/gpu-node.yaml
@@ -20,6 +20,15 @@ ufw_allowed_ports:
   - { port: "430",   proto: tcp, comment: "SSH" }
   - { port: "11434", proto: tcp, comment: "Ollama API" }
   - { port: "61208", proto: tcp, comment: "Glances web UI" }
+  # host_vars replaces (not merges) the common role's ufw_allowed_ports
+  # default, so the K3s/flannel ports below must be repeated here - without
+  # them, cross-node pod traffic (e.g. DNS to CoreDNS on nik-debian) blackholes
+  # even though kubectl logs/exec/stats still work (those tunnel through the
+  # agent's outbound connection to the k3s server on 6443, not a direct
+  # inbound connection).
+  - { port: "6443",  proto: tcp, comment: "K3s API server" }
+  - { port: "10250", proto: tcp, comment: "Kubelet" }
+  - { port: "8472",  proto: udp, comment: "Flannel VXLAN" }
 
 data_dirs:
   - /data/tts-gateway