diff --git a/docs/how-to/expose-service-publicly.md b/docs/how-to/expose-service-publicly.md
index 824fc57..26b9ce6 100644
--- a/docs/how-to/expose-service-publicly.md
+++ b/docs/how-to/expose-service-publicly.md
@@ -50,7 +50,7 @@ infrastructure. They can continue to operate in parallel for private access.
 
 | Decision | Choice | Rationale |
 |----------|--------|-----------|
-| Proxy host | Fly.io (free tier) | Managed container, no server to maintain via Ansible |
+| Proxy host | Fly.io (free tier) | Managed container, no server to maintain via Ansible. Shared IPv4 + IPv6 are free for HTTP/HTTPS; dedicated IPv4 is $2/mo if a service needs non-HTTP(S) protocols |
 | Tunnel | Tailscale (existing) | Already in use, WireGuard encryption, ACL control |
 | DNS | CNAME at [[gandi]] | No DNS migration needed, no Cloudflare dependency |
 | TLS (public) | Fly.io auto-provisions Let's Encrypt | No cert management, `$0.10/mo` per hostname |
@@ -323,10 +323,19 @@ set -euo pipefail
 
 APP="blumeops-proxy"
 
-# Fetch Tailscale auth key from 1Password
-TS_AUTHKEY=$(op --vault vg6xf6vvfmoh5hqjjhlhbeoaie item get <FLY_ITEM_ID> --fields ts-authkey --reveal)
-fly secrets set TS_AUTHKEY="$TS_AUTHKEY" -a "$APP"
-echo "Tailscale auth key set"
+# Fetch Tailscale auth key from Pulumi state
+echo "Fetching Tailscale auth key from Pulumi..."
+TS_AUTHKEY=$(cd "$(dirname "$0")/../pulumi/tailscale" && pulumi stack select tail8d86e && pulumi stack output flyio_authkey --show-secrets)
+fly secrets set TS_AUTHKEY="$TS_AUTHKEY" --stage -a "$APP"
+echo "Tailscale auth key staged (will take effect on next deploy)"
+
+# Allocate IPs (idempotent — fly errors if already allocated)
+# Shared IPv4 is free and sufficient for HTTP/HTTPS services.
+# Use 'fly ips allocate-v4' (no --shared) for dedicated IPv4 ($2/mo)
+# if the service needs non-HTTP protocols.
+fly ips allocate-v4 --shared -a "$APP" 2>/dev/null || true
+fly ips allocate-v6 -a "$APP" 2>/dev/null || true
+echo "IPs allocated"
 
 # Add certs for all public domains (idempotent — fly ignores duplicates)
 fly certs add docs.eblu.me -a "$APP" 2>/dev/null || true
diff --git a/mise-tasks/fly-setup b/mise-tasks/fly-setup
index c5b1c71..241c7fb 100755
--- a/mise-tasks/fly-setup
+++ b/mise-tasks/fly-setup
@@ -7,9 +7,17 @@ APP="blumeops-proxy"
 
 # Fetch Tailscale auth key from Pulumi state
 echo "Fetching Tailscale auth key from Pulumi..."
-TS_AUTHKEY=$(cd "$(dirname "$0")/../pulumi/tailscale" && pulumi stack output flyio_authkey --show-secrets)
-fly secrets set TS_AUTHKEY="$TS_AUTHKEY" -a "$APP"
-echo "Tailscale auth key set"
+TS_AUTHKEY=$(cd "$(dirname "$0")/../pulumi/tailscale" && pulumi stack select tail8d86e && pulumi stack output flyio_authkey --show-secrets)
+fly secrets set TS_AUTHKEY="$TS_AUTHKEY" --stage -a "$APP"
+echo "Tailscale auth key staged (will take effect on next deploy)"
+
+# Allocate IPs (idempotent — fly errors if already allocated)
+# Shared IPv4 is free and sufficient for HTTP/HTTPS services.
+# Use 'fly ips allocate-v4' (no --shared) for dedicated IPv4 ($2/mo)
+# if the service needs non-HTTP protocols.
+fly ips allocate-v4 --shared -a "$APP" 2>/dev/null || true
+fly ips allocate-v6 -a "$APP" 2>/dev/null || true
+echo "IPs allocated"
 
 # Add certs for all public domains (idempotent — fly ignores duplicates)
 fly certs add docs.eblu.me -a "$APP" 2>/dev/null || true