diff --git a/app/Provisioning/Steps/Host/ConfigureWireguard.php b/app/Provisioning/Steps/Host/ConfigureWireguard.php
index e9add02..0f0120d 100644
--- a/app/Provisioning/Steps/Host/ConfigureWireguard.php
+++ b/app/Provisioning/Steps/Host/ConfigureWireguard.php
@@ -63,7 +63,7 @@ class ConfigureWireguard extends HostStep
 
         // Always verify the tunnel is up — including the idempotent replay path,
         // so we never advance onto Proxmox API calls over a dead tunnel.
-        $hubIp = (string) config('provisioning.wireguard.hub_ip', '10.66.0.1');
+        $hubIp = (string) config('provisioning.wireguard.hub_ip');
         if (! $this->shell->run('ping -c1 -W2 '.escapeshellarg($hubIp))->ok()) {
             return StepResult::retry(15, 'WireGuard handshake not up yet');
         }
diff --git a/config/provisioning.php b/config/provisioning.php
index d075ad7..ee321f7 100644
--- a/config/provisioning.php
+++ b/config/provisioning.php
@@ -1,6 +1,9 @@
 <?php
 
 use App\Provisioning\Steps\Host;
+use Illuminate\Support\Str;
+
+$wgSubnet = env('CLUPILOT_WG_SUBNET', '10.66.0.0/24');
 
 return [
     /*
@@ -25,7 +28,8 @@ return [
 
     // CluPilot VM acts as the WireGuard hub; hosts join it during onboarding.
     'wireguard' => [
-        'subnet' => env('CLUPILOT_WG_SUBNET', '10.66.0.0/24'),
+        'subnet' => $wgSubnet,
+        'hub_ip' => env('CLUPILOT_WG_HUB_IP', Str::beforeLast($wgSubnet, '.').'.1'), // handshake target
         'endpoint' => env('CLUPILOT_WG_ENDPOINT', ''),        // host:port reachable by peers
         'hub_public_key' => env('CLUPILOT_WG_HUB_PUBKEY', ''),
         'config_path' => env('CLUPILOT_WG_CONFIG_PATH', '/etc/wireguard/wg0.conf'),