diff --git a/CLAUDE.md b/CLAUDE.md
index 6804513..d903fcc 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -271,11 +271,12 @@ When setting up Tailscale with `--ssh` on an unprivileged LXC container:
    sed -i 's/^#Port 22/Port 2222/' /etc/ssh/sshd_config
 
    # Override ssh.socket (Ubuntu 24.04 uses socket activation)
+   # ListenStream= clears defaults, then bind explicitly to IPv4
    mkdir -p /etc/systemd/system/ssh.socket.d
    cat > /etc/systemd/system/ssh.socket.d/override.conf << EOF
    [Socket]
    ListenStream=
-   ListenStream=2222
+   ListenStream=0.0.0.0:2222
    EOF
    systemctl daemon-reload
    systemctl restart ssh.socket ssh.service