diff --git a/infra/rpi-services/README.md b/infra/rpi-services/README.md
index 56df643..37f207c 100644
--- a/infra/rpi-services/README.md
+++ b/infra/rpi-services/README.md
@@ -11,6 +11,9 @@ Kubernetes cluster:
 
 Pi-hole also keeps public fallback upstreams in its config, so DNS can continue
 to resolve through `1.1.1.1` and `9.9.9.9` if the Unbound container stops.
+For Pi-hole v6, the stack sets `FTLCONF_dns_interface=ALL` through
+`PIHOLE_DNS_INTERFACE` so LAN clients such as the Debian control host are not
+rejected as non-local networks.
 
 The bootstrap script prefers Docker data under `/nvme-storage/docker` only when
 that path is an active mount point and writable. If the NVMe is missing or
@@ -32,6 +35,7 @@ Useful overrides:
 ```bash
 LAB_RPI_HOST=192.168.100.89 ./jeannie rpi-services
 PIHOLE_WEBPASSWORD='<password>' ./jeannie rpi-services
+PIHOLE_DNS_INTERFACE=ALL ./jeannie rpi-services
 PIHOLE_WEB_PORT=8081 UPTIME_KUMA_PORT=3001 ./jeannie rpi-services
 LAB_RPI_STOP_LEGACY_PIHOLE=false ./jeannie rpi-services
 ```
diff --git a/infra/rpi-services/bootstrap.sh b/infra/rpi-services/bootstrap.sh
index 08b9000..9df8b13 100755
--- a/infra/rpi-services/bootstrap.sh
+++ b/infra/rpi-services/bootstrap.sh
@@ -140,6 +140,7 @@ PIHOLE_WEB_PORT=${PIHOLE_WEB_PORT:-8081}
 PIHOLE_DNS_BIND_IP=${PIHOLE_DNS_BIND_IP:-0.0.0.0}
 PIHOLE_WEB_BIND_IP=${PIHOLE_WEB_BIND_IP:-0.0.0.0}
 PIHOLE_WEBPASSWORD=${PIHOLE_WEBPASSWORD}
+PIHOLE_DNS_INTERFACE=${PIHOLE_DNS_INTERFACE:-ALL}
 PIHOLE_UPSTREAMS=${PIHOLE_UPSTREAMS:-unbound#53;1.1.1.1;9.9.9.9}
 PIHOLE_DATA_DIR=${PIHOLE_DATA_DIR:-${DATA_DIR}/pihole/etc-pihole}
 PIHOLE_DNSMASQ_DIR=${PIHOLE_DNSMASQ_DIR:-${DATA_DIR}/pihole/etc-dnsmasq.d}
diff --git a/infra/rpi-services/docker-compose.yml b/infra/rpi-services/docker-compose.yml
index 8471611..af97095 100644
--- a/infra/rpi-services/docker-compose.yml
+++ b/infra/rpi-services/docker-compose.yml
@@ -22,6 +22,7 @@ services:
       TZ: ${TZ:-America/Mexico_City}
       WEBPASSWORD: ${PIHOLE_WEBPASSWORD:-homelab-change-me}
       DNSMASQ_LISTENING: all
+      FTLCONF_dns_interface: ${PIHOLE_DNS_INTERFACE:-ALL}
       PIHOLE_DNS_: ${PIHOLE_UPSTREAMS:-unbound#53;1.1.1.1;9.9.9.9}
       FTLCONF_dns_upstreams: ${PIHOLE_UPSTREAMS:-unbound#53;1.1.1.1;9.9.9.9}
       REV_SERVER: ${PIHOLE_REV_SERVER:-false}