diff --git a/hosts/heather/mesh-clients.nix b/hosts/heather/mesh-clients.nix
index 92b5c12..41c35ca 100644
--- a/hosts/heather/mesh-clients.nix
+++ b/hosts/heather/mesh-clients.nix
@@ -20,6 +20,12 @@
 
   networking.firewall.allowedUDPPorts = [ 51821 ];
 
+  # allowedIPsAsRoutes=false keeps peer declarations as crypto ACLs; install
+  # the client identity route explicitly, as in the backbone design.
+  networking.interfaces.wg-clients1.ipv4.routes = [
+    { address = "10.0.1.10"; prefixLength = 32; }
+  ];
+
   systemd.tmpfiles.rules = [
     "d /var/lib/wireguard 0700 root root -"
   ];
diff --git a/hosts/heather/mesh-egress.nix b/hosts/heather/mesh-egress.nix
index 99d941e..29a7069 100644
--- a/hosts/heather/mesh-egress.nix
+++ b/hosts/heather/mesh-egress.nix
@@ -4,7 +4,7 @@
 { config, pkgs, ... }:
 let
   ip = "${pkgs.iproute2}/bin/ip";
-  getent = "${pkgs.glibc}/bin/getent";
+  getent = "${pkgs.getent}/bin/getent";
   routeScript = pkgs.writeShellScript "mesh-egress-routes" ''
     set -eu
     ${ip} link show wg-mesh >/dev/null