diff --git a/config/provisioning.php b/config/provisioning.php
index ee321f7..2fd11e5 100644
--- a/config/provisioning.php
+++ b/config/provisioning.php
@@ -1,9 +1,11 @@
 <?php
 
 use App\Provisioning\Steps\Host;
-use Illuminate\Support\Str;
 
 $wgSubnet = env('CLUPILOT_WG_SUBNET', '10.66.0.0/24');
+[$wgNetwork, $wgBits] = array_pad(explode('/', $wgSubnet), 2, '24');
+$wgBase = ip2long($wgNetwork) & (0xFFFFFFFF << (32 - (int) $wgBits)) & 0xFFFFFFFF;
+$wgHubDefault = long2ip($wgBase + 1); // first usable address in the CIDR
 
 return [
     /*
@@ -29,7 +31,7 @@ return [
     // CluPilot VM acts as the WireGuard hub; hosts join it during onboarding.
     'wireguard' => [
         'subnet' => $wgSubnet,
-        'hub_ip' => env('CLUPILOT_WG_HUB_IP', Str::beforeLast($wgSubnet, '.').'.1'), // handshake target
+        'hub_ip' => env('CLUPILOT_WG_HUB_IP', $wgHubDefault), // handshake target
         'endpoint' => env('CLUPILOT_WG_ENDPOINT', ''),        // host:port reachable by peers
         'hub_public_key' => env('CLUPILOT_WG_HUB_PUBKEY', ''),
         'config_path' => env('CLUPILOT_WG_CONFIG_PATH', '/etc/wireguard/wg0.conf'),