diff --git a/ansible/roles/podman/files/hass/configuration.yaml b/ansible/roles/podman/files/hass/configuration.yaml
index 82f66c8..04c73ae 100644
--- a/ansible/roles/podman/files/hass/configuration.yaml
+++ b/ansible/roles/podman/files/hass/configuration.yaml
@@ -9,6 +9,11 @@ http:
   use_x_forwarded_for: true
   trusted_proxies:
     - 127.0.0.1
+    # Caddy runs on the host network and reaches us through the published
+    # port, so pasta (rootless podman's default since v5) rewrites the source
+    # to the container's own link-local tap0 address, not 10.0.2.x as
+    # slirp4netns used to.
+    - 169.254.0.0/16
     - 10.0.0.0/8
     - 192.168.1.0/24
 
diff --git a/ansible/roles/podman/tasks/main.yml b/ansible/roles/podman/tasks/main.yml
index b41c4a7..edae065 100644
--- a/ansible/roles/podman/tasks/main.yml
+++ b/ansible/roles/podman/tasks/main.yml
@@ -39,7 +39,7 @@
 
 - import_tasks: containers/home/hass.yml
   vars:
-    image: ghcr.io/home-assistant/home-assistant:2026.5.1
+    image: ghcr.io/home-assistant/home-assistant:2026.8.3
   tags: hass
 
 - import_tasks: containers/home/partsy.yml
@@ -81,13 +81,13 @@
 
 - import_tasks: containers/debyltech/fulfillr.yml
   vars:
-    image: git.debyl.io/debyltech/fulfillr:20260827.1453
+    image: git.debyl.io/debyltech/fulfillr:20260827.2009
   tags: debyltech, fulfillr
 
 # Staging back-office (fulfillr-dev.debyltech.com) — same image, staging Turso config.
 - import_tasks: containers/debyltech/fulfillr-dev.yml
   vars:
-    image: git.debyl.io/debyltech/fulfillr:20260825.1909
+    image: git.debyl.io/debyltech/fulfillr:20260827.2009
   tags: debyltech, fulfillr-dev
 
 - import_tasks: containers/debyltech/uptime-kuma.yml