diff --git a/velero/restore-drill/20-restore-drill-cronjob.yaml b/velero/restore-drill/20-restore-drill-cronjob.yaml
index e7a91e3..70f9cce 100644
--- a/velero/restore-drill/20-restore-drill-cronjob.yaml
+++ b/velero/restore-drill/20-restore-drill-cronjob.yaml
@@ -28,6 +28,17 @@ spec:
         spec:
           restartPolicy: Never
           serviceAccountName: restore-drill
+          # DEV-579: public DNS for paperclip.home.imicros.de returns the LAN IP
+          # 10.0.0.2 (split-brain), which is unroutable from the cluster. The
+          # home reverse proxy at home.imicros.de (46.225.155.185) already
+          # serves the paperclip.home.imicros.de vhost publicly, so overriding
+          # the hostname to that public IP lets the webhook reach the routine.
+          # If the home ISP rotates the public IP, refresh this entry from
+          # `dig +short home.imicros.de` (DDNS record).
+          hostAliases:
+            - ip: "46.225.155.185"
+              hostnames:
+                - "paperclip.home.imicros.de"
           securityContext:
             runAsNonRoot: true
             runAsUser: 65532
diff --git a/velero/restore-drill/README.md b/velero/restore-drill/README.md
index d63a34a..b2a7cc2 100644
--- a/velero/restore-drill/README.md
+++ b/velero/restore-drill/README.md
@@ -24,8 +24,9 @@ Velero cluster-reconstruction backup layer.
 6. Writes the final report to ConfigMap `velero/velero-restore-drill-last-result`
    and logs it to stdout.
 7. Optionally POSTs a JSON payload to the Paperclip routine webhook if
-   the `velero-restore-drill-webhook` Secret is present (currently unreachable
-   from the cluster — see follow-up ticket).
+   the `velero-restore-drill-webhook` Secret is present. The CronJob uses a
+   `hostAliases` entry to route `paperclip.home.imicros.de` at the home
+   public IP so the webhook reaches the routine from Hetzner (DEV-579).
 
 ## Failure signalling