diff --git a/nix/lib/config/options.nix b/nix/lib/config/options.nix
index 76d42a1..a8e47f0 100644
--- a/nix/lib/config/options.nix
+++ b/nix/lib/config/options.nix
@@ -394,6 +394,11 @@ let
         default = [];
         description = "Accept default routes from these OSPF routers, in order of preference";
       };
+      ospf.allowedUpstreams6 = mkOption {
+        type = with types; listOf str;
+        default = config.site.hosts.${name}.ospf.allowedUpstreams;
+        description = "Accept IPv6 default routes from these OSPF3 routers, in order of preference";
+      };
       ospf.upstreamInstance = mkOption {
         type = with types; nullOr int;
         default = null;
diff --git a/nix/nixos-module/container/bird.nix b/nix/nixos-module/container/bird.nix
index 0fe94ea..aedbffa 100644
--- a/nix/nixos-module/container/bird.nix
+++ b/nix/nixos-module/container/bird.nix
@@ -227,7 +227,11 @@ in
                       builtins.mapAttrs (net: _:
                         # Enable OSPF only on interfaces with a secret.
                         lib.optionalString (config.site.net.${net}.ospf.secret != null) ''
-                          interface "${net}" instance ${toString config.site.hosts.${upstream}.ospf.upstreamInstance} {
+                          interface "${net}" instance ${
+                            builtins.replaceStrings [ "-" ] [ "_" ] (
+                              toString config.site.hosts.${upstream}.ospf.upstreamInstance
+                            )
+                          } {
                             hello 10;
                             wait 20;
                             authentication cryptographic;
@@ -333,7 +337,11 @@ in
                       builtins.mapAttrs (net: _:
                         # Enable OSPF only on interfaces with a secret.
                         lib.optionalString (config.site.net.${net}.ospf.secret != null) ''
-                          interface "${net}" instance ${toString config.site.hosts.${upstream}.ospf.upstreamInstance} {
+                          interface "${net}" instance ${
+                            builtins.replaceStrings [ "-" ] [ "_" ] (
+                              toString config.site.hosts.${upstream}.ospf.upstreamInstance
+                            )
+                          } {
                             hello 10;
                             wait 20;
                             authentication cryptographic;
@@ -347,7 +355,7 @@ in
             }
           '';
           n = n + 1;
-        }) { text = ""; n = 0; } hostConf.ospf.allowedUpstreams
+        }) { text = ""; n = 0; } hostConf.ospf.allowedUpstreams6
       ).text}
 
       # Zentralwerk DN42