diff --git a/hosts/heather/astrnet.nix b/hosts/heather/astrnet.nix
index 0780b46..1113df1 100644
--- a/hosts/heather/astrnet.nix
+++ b/hosts/heather/astrnet.nix
@@ -83,7 +83,7 @@ in {
   # WireGuard peers use allowedIPs 0/0 as an ACL, so do not rely on a packet's
   # source address to identify a particular AstrNet client here.
   systemd.services.astrnet-guard = {
-    description = "Allow AstrNet host ingress; block AstrNet transit";
+    description = "Allow AstrNet ingress and Docker replies; block new transit";
     wantedBy = [ "multi-user.target" ];
     requiredBy = [ "wireguard-wg-mic-der.service" "wireguard-wg-mic-bd8.service" ];
     before = [ "wireguard-wg-mic-der.service" "wireguard-wg-mic-bd8.service" ];
@@ -102,8 +102,16 @@ in {
         }
         chain forward {
           type filter hook forward priority -150; policy accept;
+          # Only replies to Docker-initiated connections, never new mesh transit.
+          iifname { "wg-mic-der", "wg-mic-bd8" } ct state established,related accept
           iifname { "wg-mic-der", "wg-mic-bd8" } drop
         }
+        chain postrouting {
+          type nat hook postrouting priority 99; policy accept;
+          # Docker's own MASQUERADE would use the tunnel transit IP, which
+          # AstrNet exits do not NAT. Use the advertised mesh identity instead.
+          oifname { "wg-mic-der", "wg-mic-bd8" } ip saddr { 172.17.0.0/16, 172.18.0.0/16, 172.19.0.0/16 } snat to ${id4}
+        }
       }
       RULES
     '';