diff --git a/modules/binarylane/main.tf b/modules/binarylane/main.tf
index 01562e3..02162c7 100644
--- a/modules/binarylane/main.tf
+++ b/modules/binarylane/main.tf
@@ -7,18 +7,18 @@ locals {
 
   # only these destinations route over wg0; everything else (incl. SMTP) stays public
   wg_allowed_ips = [
-    "10.10.13.1/32",     # prodnxsr0020 tunnel address
-    "10.10.12.200/32",   # management ssh client (wireguard workstation)
-    "198.18.200.2/32",   # puppetca.k8s.syd1.au.unkin.net
-    "198.18.200.3/32",   # puppet.k8s.syd1.au.unkin.net
-    "198.18.200.4/32",   # artifactapi.k8s.syd1.au.unkin.net (package repos)
-    "198.18.200.7/32",   # bind-internal resolvers
-    "198.18.200.17/32",  # rspamd milter :11332
-    "198.18.25.78/32",   # vault.service.consul
-    "198.18.26.197/32",  # vault.service.consul
-    "198.18.27.116/32",  # vault.service.consul
-    "198.18.28.248/32",  # vault.service.consul
-    "198.18.29.92/32",   # vault.service.consul
+    "10.10.13.1/32",    # prodnxsr0020 tunnel address
+    "10.10.12.200/32",  # management ssh client (wireguard workstation)
+    "198.18.200.2/32",  # puppetca.k8s.syd1.au.unkin.net
+    "198.18.200.3/32",  # puppet.k8s.syd1.au.unkin.net
+    "198.18.200.4/32",  # artifactapi.k8s.syd1.au.unkin.net (package repos)
+    "198.18.200.7/32",  # bind-internal resolvers
+    "198.18.200.17/32", # rspamd milter :11332
+    "198.18.25.78/32",  # vault.service.consul
+    "198.18.26.197/32", # vault.service.consul
+    "198.18.27.116/32", # vault.service.consul
+    "198.18.28.248/32", # vault.service.consul
+    "198.18.29.92/32",  # vault.service.consul
   ]
 
   vpcs = {