diff --git a/hosts/valefar/bonsai.nix b/hosts/valefar/bonsai.nix
index efc501d..f4a9a95 100644
--- a/hosts/valefar/bonsai.nix
+++ b/hosts/valefar/bonsai.nix
@@ -115,17 +115,20 @@ in
   };
 
   # The host firewall is off, so a wildcard bind would also expose the
-  # docker bridges, the wireguard mesh, the PIA containers and the VMs.
+  # docker bridges, the PIA containers and the VMs. The wisp mesh address is
+  # bound on purpose: wisp's moderation service on baal asks bonsai for a
+  # first pass over new sites.
   systemd.sockets.bonsai2-lan = {
     wantedBy = [ "sockets.target" ];
     listenStreams = [
       "10.0.0.30:${toString port}"
       "100.64.0.11:${toString port}"
+      "10.88.0.10:${toString port}"
     ];
     socketConfig.FreeBind = true;
   };
   systemd.services.bonsai2-lan = {
-    description = "Bonsai 2 API proxy for the LAN and tailnet";
+    description = "Bonsai 2 API proxy for the LAN, tailnet and wisp mesh";
     requires = [ "bonsai2.service" ];
     after = [ "bonsai2.service" ];
     serviceConfig.ExecStart = "${config.systemd.package}/lib/systemd/systemd-socket-proxyd 127.0.0.1:${toString port}";