diff --git a/apps/guacamole/guacamole.yaml b/apps/guacamole/guacamole.yaml
index 6f52dc4..ca5c067 100644
--- a/apps/guacamole/guacamole.yaml
+++ b/apps/guacamole/guacamole.yaml
@@ -543,7 +543,15 @@ spec:
                 - /scripts/sync-k8s-connections.sh
               env:
                 - name: GUAC_URL
-                  value: "http://guacamole.guacamole.svc.cluster.local:8080"
+                  # Short name on purpose: CoreDNS has an *.iamworkin.lan
+                  # template wildcard that resolves
+                  # guacamole.guacamole.svc.cluster.local.iamworkin.lan
+                  # (search-expanded before the bare FQDN gets tried with
+                  # ndots:5) to the Traefik LB VIP 10.0.56.200, which has
+                  # no pod-network hairpin route. The short name leans on
+                  # the namespace's own search suffix and hits the
+                  # Kubernetes CoreDNS plugin directly.
+                  value: "http://guacamole:8080"
                 - name: GUAC_ADMIN_USER
                   value: "guacadmin"
                 - name: GUAC_ADMIN_PASSWORD