diff --git a/docs/IPS.md b/docs/IPS.md
index c73aeed..c4ccf4f 100644
--- a/docs/IPS.md
+++ b/docs/IPS.md
@@ -3,29 +3,34 @@
 All nodes: static IP configured on the node (NetworkManager, "Wired
 connection 1", manual, /22, gateway+DNS 192.168.1.1 = UDM Pro).
 
+Every node is also on the owner's Tailscale tailnet (always-on) — the second
+IP is reachable from anywhere via the tailnet, including the laptop
+kubeconfig (API: https://100.124.112.13:6443 = planck002's Tailscale IP,
+added to k3s tls-san on all three servers).
+
 RECOMMENDED follow-up: add these as DHCP reservations in UniFi too, so the
 router never leases these addresses to other devices. (UniFi UI: each client
 device → Fixed IP. API is blocked by MFA.)
 
-| Node | IP | MAC |
+| Node | LAN IP | Tailscale IP | MAC |
 |------|----|----|
-| planck001 | 192.168.2.245 | dc:a6:32:e9:7f:75 |
-| planck002 | 192.168.0.110 | dc:a6:32:e9:7f:de |
-| planck003 | 192.168.1.109 | dc:a6:32:e9:7d:fa |
-| planck004 | 192.168.2.250 | dc:a6:32:e9:7f:7b |
-| planck005 | 192.168.2.178 | dc:a6:32:e9:7f:33 |
-| planck006 | 192.168.1.2 | dc:a6:32:e9:7d:8b |
-| planck007 | 192.168.1.48 | dc:a6:32:e9:7d:bd |
-| planck008 | 192.168.2.43 | dc:a6:32:e9:7e:b2 |
-| planck009 | 192.168.1.82 | dc:a6:32:e9:7d:df |
-| planck010 | 192.168.2.91 | dc:a6:32:e9:7e:e2 |
-| planck011 | 192.168.0.185 | dc:a6:32:e9:7d:46 |
-| planck012 | 192.168.0.235 | dc:a6:32:e9:7d:78 |
-| planck013 | 192.168.2.230 | dc:a6:32:e9:7f:67 |
-| planck014 | 192.168.2.4 | dc:a6:32:e9:78:d1 |
-| planck015 | 192.168.2.31 | dc:a6:32:e9:78:ec |
-| planck016 | 192.168.2.94 | dc:a6:32:e9:7e:e5 |
-| planck017 | 192.168.1.94 | dc:a6:32:e9:7d:eb |
-| planck018 | 192.168.2.102 | dc:a6:32:e9:7e:ed |
-| planck019 | 192.168.2.32 | dc:a6:32:e9:7e:a6 |
-| planck020 | 192.168.1.23 | dc:a6:32:e9:7d:a4 |
+| planck001 | 192.168.2.245 | 100.95.205.28 | dc:a6:32:e9:7f:75 |
+| planck002 | 192.168.0.110 | 100.124.112.13 | dc:a6:32:e9:7f:de |
+| planck003 | 192.168.1.109 | 100.98.49.13 | dc:a6:32:e9:7d:fa |
+| planck004 | 192.168.2.250 | 100.93.201.48 | dc:a6:32:e9:7f:7b |
+| planck005 | 192.168.2.178 | 100.98.22.50 | dc:a6:32:e9:7f:33 |
+| planck006 | 192.168.1.2 | 100.117.72.42 | dc:a6:32:e9:7d:8b |
+| planck007 | 192.168.1.48 | 100.116.208.66 | dc:a6:32:e9:7d:bd |
+| planck008 | 192.168.2.43 | 100.125.106.86 | dc:a6:32:e9:7e:b2 |
+| planck009 | 192.168.1.82 | 100.91.196.17 | dc:a6:32:e9:7d:df |
+| planck010 | 192.168.2.91 | 100.65.93.90 | dc:a6:32:e9:7e:e2 |
+| planck011 | 192.168.0.185 | 100.68.40.111 | dc:a6:32:e9:7d:46 |
+| planck012 | 192.168.0.235 | 100.98.229.124 | dc:a6:32:e9:7d:78 |
+| planck013 | 192.168.2.230 | 100.121.93.41 | dc:a6:32:e9:7f:67 |
+| planck014 | 192.168.2.4 | 100.68.35.118 | dc:a6:32:e9:78:d1 |
+| planck015 | 192.168.2.31 | 100.108.69.67 | dc:a6:32:e9:78:ec |
+| planck016 | 192.168.2.94 | 100.88.118.95 | dc:a6:32:e9:7e:e5 |
+| planck017 | 192.168.1.94 | 100.72.37.121 | dc:a6:32:e9:7d:eb |
+| planck018 | 192.168.2.102 | 100.114.149.34 | dc:a6:32:e9:7e:ed |
+| planck019 | 192.168.2.32 | 100.113.193.126 | dc:a6:32:e9:7e:a6 |
+| planck020 | 192.168.1.23 | 100.104.220.31 | dc:a6:32:e9:7d:a4 |