diff --git a/inventories/production/group_vars/all/vars.yml b/inventories/production/group_vars/all/vars.yml
index b38232c..50b4f86 100644
--- a/inventories/production/group_vars/all/vars.yml
+++ b/inventories/production/group_vars/all/vars.yml
@@ -36,3 +36,6 @@ services__base_dir: /opt/services
 
 # Unattended upgrades — security patches only
 base__unattended_upgrades_enabled: true
+
+# Management plane — activates the dormant ssh-from-control firewall rule
+base__firewall_control_addr: "10.20.10.151"  # ubongo (control node) LAN address — ADR-021 ssh-from-control source
diff --git a/inventories/production/hosts.yml b/inventories/production/hosts.yml
index 36ef5de..2ec35b0 100644
--- a/inventories/production/hosts.yml
+++ b/inventories/production/hosts.yml
@@ -7,7 +7,9 @@
 all:
   children:
     control:
-      hosts: {}
+      hosts:
+        ubongo:
+          ansible_host: 10.20.10.151
     docker_hosts:
       hosts: {}
     proxmox_hosts: