diff --git a/hosts/heather/astrnet.nix b/hosts/heather/astrnet.nix
index 6bc88b2..7afaa82 100644
--- a/hosts/heather/astrnet.nix
+++ b/hosts/heather/astrnet.nix
@@ -125,7 +125,7 @@ in {
           type nat hook postrouting priority 99; policy accept;
           # Docker's own MASQUERADE would use the tunnel transit IP, which
           # AstrNet exits do not NAT. Use the advertised mesh identity instead.
-          oifname { "wg-mic-der", "wg-mic-bd8" } ip saddr { 172.17.0.0/16, 172.18.0.0/16, 172.19.0.0/16 } snat to ${id4}
+          oifname { "wg-mic-der", "wg-mic-bd8" } ip saddr { 172.17.0.0/16, 172.18.0.0/16, 172.19.0.0/16, 172.21.0.0/16 } snat to ${id4}
         }
       }
       RULES