diff --git a/hw/straylight/default.nix b/hw/straylight/default.nix
index d8a0e83..4edbf96 100644
--- a/hw/straylight/default.nix
+++ b/hw/straylight/default.nix
@@ -460,6 +460,14 @@ in
       libsecret
     ];
 
+    # Prefer IPv4 for outbound connections. straylight has a Tailscale IPv6
+    # ULA (fd7a::/128) but no public IPv6 default route, so getaddrinfo can
+    # return unroutable AAAA records and HTTPS to IPv6-capable hosts (e.g. the
+    # Hermes update CDN hermes-assets.nousresearch.com) intermittently fails
+    # with "Channel read unavailable". RFC 3484 sorts IPv6 (40) above
+    # IPv4-mapped (10); bump IPv4-mapped to 100 so IPv4 is tried first.
+    environment.etc."gai.conf".text = "precedence ::ffff:0:0/96  100\n";
+
     # Headless Chromium exposing a CDP endpoint for Hermes browser tools.
     # Loopback only; browser.cdp_url in ~/.hermes/config.yaml points at it.
     # Ungoogled-chromium (already in desktop-packages-light.nix), no ad-block