diff --git a/hosts/dns.windy.lan.md b/hosts/dns.windy.lan.md
index 0b0e0ef..63bc9ad 100644
--- a/hosts/dns.windy.lan.md
+++ b/hosts/dns.windy.lan.md
@@ -32,10 +32,17 @@ Do not enable AdGuard Home DHCP unless the existing EdgeRouter DHCP service is
 explicitly migrated and disabled first.
 
 `agh-ui-access.service` loads `/etc/nftables-agh-ui-access.nft`.  It permits
-only `192.168.66.0/24` to TCP/80 and drops other TCP/80 input.  It deliberately
+`192.168.66.0/24` (LAN66) and `192.168.55.0/24` (LAN55, for Home Assistant
+integration) to TCP/80 and drops other TCP/80 input.  It deliberately
 does **not** restrict DNS, SSH, Docker, or Mihomo ports.  Keep it isolated from
 Docker-managed nftables tables.
 
+> 2026-08-12: added `192.168.55.0/24` allow so HAOS (`192.168.55.11`) can reach
+the HTTP API on `:80` for the Home Assistant AdGuard Home integration; applied
+via `sudo systemctl restart agh-ui-access.service` (file edited first, then
+reloaded; syntax verified with `nft -c`). Other firewalls (EdgeRouter LAN_IN/
+LAN_OUT inactive, PVE zero rules) were already open for LAN55->LAN66.
+
 Current query-log policy is 14 days with anonymized client IPs.  Check free
 space before increasing retention.  DNSSEC is disabled because the selected
 upstream path did not pass the known-bad-signature validation check; do not