diff --git a/nix/nixos-module/container/upstream.nix b/nix/nixos-module/container/upstream.nix
index 679f3da..504eb2f 100644
--- a/nix/nixos-module/container/upstream.nix
+++ b/nix/nixos-module/container/upstream.nix
@@ -56,6 +56,7 @@ in
     enable = true;
     internalInterfaces = [ "core" ];
     externalInterface = firstUpstreamInterface;
+    externalIP = upstreamInterfaces.${firstUpstreamInterface}.upstream.staticIpv4Address;
     extraCommands =
       # Provide IPv6 upstream for everyone, using NAT66 when not from
       # our static prefixes