diff --git a/apps/base/woodpecker/configmap_gocache-nginx.yaml b/apps/base/woodpecker/configmap_gocache-nginx.yaml
index 2c7fe91..ca1eaeb 100644
--- a/apps/base/woodpecker/configmap_gocache-nginx.yaml
+++ b/apps/base/woodpecker/configmap_gocache-nginx.yaml
@@ -24,6 +24,8 @@ data:
 
         # The protocol has no authentication: anyone who can reach this port can
         # write cache entries, which become code in every build that reads them.
+        # Loopback is the kubectl port-forward fallback; in a pod netns it is
+        # only these two containers.
         allow 127.0.0.1/32;
         allow 10.10.12.200/32;
         allow 10.42.0.0/16;
diff --git a/apps/base/woodpecker/service_gocache.yaml b/apps/base/woodpecker/service_gocache.yaml
index cd51221..7cf0d7e 100644
--- a/apps/base/woodpecker/service_gocache.yaml
+++ b/apps/base/woodpecker/service_gocache.yaml
@@ -4,10 +4,16 @@ kind: Service
 metadata:
   name: gocache
   namespace: woodpecker
+  annotations:
+    purelb.io/addresses: 198.18.200.11
+    purelb.io/service-group: common
   labels:
     app.kubernetes.io/name: gocache
 spec:
-  type: ClusterIP
+  type: LoadBalancer
+  # Cluster SNATs off-node traffic to a node address, which would defeat the
+  # nginx allow rules; Local preserves the wireguard client IP.
+  externalTrafficPolicy: Local
   selector:
     app.kubernetes.io/name: gocache
   ports: