diff --git a/ansible/group_vars/nodito_vms.yml b/ansible/group_vars/nodito_vms.yml
new file mode 100644
index 0000000..2ff6994
--- /dev/null
+++ b/ansible/group_vars/nodito_vms.yml
@@ -0,0 +1,17 @@
+---
+# Reach the VMs over Tailscale, and fall back to the LAN if the tailnet is down.
+#
+# ansible_host is a MagicDNS name. If tailscaled is not running on the control
+# node that name does not resolve, so `nc %h %p` fails fast and the second nc
+# takes over on the LAN address recorded as lan_ip in inventory.ini.
+#
+# This is safe against the LAN addresses drifting again (which is how
+# fulcrum/mempool came to be transposed): known_hosts is keyed to the MagicDNS
+# NAME, so if lan_ip ever points at a different machine the host key will not
+# match and ssh aborts. Verified 2026-09-12 by pointing fulcrum-box at
+# mempool-box's address: "Host key verification failed."
+#
+# lan_ip is a convenience, not an identity. If it goes stale the fallback stops
+# working; it will never connect you to the wrong box.
+ansible_ssh_common_args: >-
+  -o ProxyCommand="sh -c 'nc -w2 %h %p 2>/dev/null || nc -w4 {{ lan_ip }} %p'"