diff --git a/apps/qbittorrent/deployment.yaml b/apps/qbittorrent/deployment.yaml
index fee12ad..f566e76 100644
--- a/apps/qbittorrent/deployment.yaml
+++ b/apps/qbittorrent/deployment.yaml
@@ -62,11 +62,12 @@ spec:
               value: wg0
             - name: VPN_PROVIDER
               value: proton
-            # Permit ingress-nginx and the media application Pods to reach the
-            # Web UI/API without allowing ordinary internet traffic to bypass
-            # the VPN. The LAN range is also retained for cluster-local access.
+            # Permit the physical LAN to reach the Web UI/API without allowing
+            # ordinary internet traffic to bypass the VPN. Do not add the
+            # Kubernetes Pod CIDR here: Hotio detects the Pod's attached network
+            # itself and rejects an overlapping VPN_LAN_NETWORK route.
             - name: VPN_LAN_NETWORK
-              value: 10.10.0.0/16,10.244.0.0/21
+              value: 10.10.0.0/16
             - name: VPN_LAN_LEAK_ENABLED
               value: "false"
             # Proton assigns a dynamic inbound port through NAT-PMP. Hotio