diff --git a/kubernetes/common.nix b/kubernetes/common.nix
index d9f9ff9..7108c64 100644
--- a/kubernetes/common.nix
+++ b/kubernetes/common.nix
@@ -4,6 +4,8 @@
   lib,
   sshPublicKey,
   k8sApiToken,
+  subnetThirdOctet ? 122,
+  nodeHosts ? "",
   ...
 }:
 {
@@ -42,12 +44,7 @@
     "1.1.1.1"
     "8.8.8.8"
   ];
-  networking.extraHosts = ''
-    192.168.122.10 k8s-master-0
-    192.168.122.11 k8s-worker-0
-    192.168.122.12 k8s-worker-1
-    192.168.122.13 k8s-worker-2
-  '';
+  networking.extraHosts = nodeHosts;
 
   # Kubernetes DNS — workers don't have apiserver.serviceClusterIpRange set,
   # so the NixOS module computes the wrong clusterDns IP (10.0.0.254 instead
diff --git a/kubernetes/master.nix b/kubernetes/master.nix
index 34e4076..70269a6 100644
--- a/kubernetes/master.nix
+++ b/kubernetes/master.nix
@@ -2,6 +2,7 @@
   config,
   pkgs,
   lib,
+  subnetThirdOctet ? 122,
   ...
 }:
 {
@@ -10,15 +11,15 @@
   networking.hostName = "k8s-master-0";
   networking.interfaces.enp1s0.ipv4.addresses = [
     {
-      address = "192.168.122.10";
+      address = "192.168.${toString subnetThirdOctet}.10";
       prefixLength = 24;
     }
   ];
-  networking.defaultGateway = "192.168.122.1";
+  networking.defaultGateway = "192.168.${toString subnetThirdOctet}.1";
 
   services.kubernetes = {
     roles = [ "master" ];
-    masterAddress = "192.168.122.10";
+    masterAddress = "192.168.${toString subnetThirdOctet}.10";
     easyCerts = true;
     pki.genCfsslAPIToken = false; # We write a fixed token via k8s-write-apitoken service
     apiserver = {
@@ -40,7 +41,7 @@
     };
     kubelet = {
       clusterDomain = "cluster.local";
-      nodeIp = "192.168.122.10";
+      nodeIp = "192.168.${toString subnetThirdOctet}.10";
     };
     addonManager.enable = true;
     proxy.enable = false; # Cilium handles kube-proxy replacement via eBPF
diff --git a/kubernetes/worker.nix b/kubernetes/worker.nix
index c9672d1..50f59a1 100644
--- a/kubernetes/worker.nix
+++ b/kubernetes/worker.nix
@@ -2,20 +2,21 @@
   config,
   pkgs,
   lib,
+  subnetThirdOctet ? 122,
   ...
 }:
 {
   imports = [ ./common.nix ];
 
-  networking.defaultGateway = "192.168.122.1";
+  networking.defaultGateway = "192.168.${toString subnetThirdOctet}.1";
 
   services.kubernetes = {
     roles = [ "node" ];
-    masterAddress = "192.168.122.10";
+    masterAddress = "192.168.${toString subnetThirdOctet}.10";
     easyCerts = true;
     kubelet = {
       clusterDomain = "cluster.local";
-      nodeIp = lib.mkDefault "192.168.122.11"; # Override per node in flake.nix
+      nodeIp = lib.mkDefault "192.168.${toString subnetThirdOctet}.11"; # Override per node in flake.nix
       extraOpts = lib.concatStringsSep " " [
         "--protect-kernel-defaults=true"
         "--read-only-port=0"