diff --git a/README.md b/README.md
index b54bd92..868e060 100644
--- a/README.md
+++ b/README.md
@@ -8,6 +8,8 @@ container images and then commits the selected image tag here; it never receives
 - `apps/immich-sync/` is the desired Kubernetes state for Immich Share Sync.
 - `apps/immichframe/` wraps the reusable ImmichFrame chart with this cluster's
   hostname, album selection, resources, and encrypted API credential.
+- `apps/metallb/` pins the upstream native MetalLB installation and owns this
+  cluster's L2 address pool.
 - `bootstrap/` contains Argo CD projects and Applications, including the
   upstream Sealed Secrets controller.
 - `scripts/update-immich-sync-image.sh` is the single image-promotion interface used by CI.
diff --git a/apps/metallb/kustomization.yaml b/apps/metallb/kustomization.yaml
new file mode 100644
index 0000000..0d22c38
--- /dev/null
+++ b/apps/metallb/kustomization.yaml
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- https://raw.githubusercontent.com/metallb/metallb/v0.16.0/config/manifests/metallb-native.yaml
+- resources.yaml
diff --git a/apps/metallb/resources.yaml b/apps/metallb/resources.yaml
new file mode 100644
index 0000000..ac21bfe
--- /dev/null
+++ b/apps/metallb/resources.yaml
@@ -0,0 +1,18 @@
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: default
+  namespace: metallb-system
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  addresses:
+  - 192.168.0.10-192.168.0.49
+---
+apiVersion: metallb.io/v1beta1
+kind: L2Advertisement
+metadata:
+  name: l2
+  namespace: metallb-system
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
diff --git a/bootstrap/install.sh b/bootstrap/install.sh
index 3dba7b3..0ed6e10 100755
--- a/bootstrap/install.sh
+++ b/bootstrap/install.sh
@@ -29,3 +29,9 @@ kubectl --namespace argocd wait application/immichframe \
 kubectl --namespace argocd wait application/immichframe \
   --for=jsonpath='{.status.health.status}'=Healthy \
   --timeout=5m
+kubectl --namespace argocd wait application/metallb \
+  --for=jsonpath='{.status.sync.status}'=Synced \
+  --timeout=5m
+kubectl --namespace argocd wait application/metallb \
+  --for=jsonpath='{.status.health.status}'=Healthy \
+  --timeout=5m
diff --git a/bootstrap/kustomization.yaml b/bootstrap/kustomization.yaml
index 2f03143..81aa493 100644
--- a/bootstrap/kustomization.yaml
+++ b/bootstrap/kustomization.yaml
@@ -6,3 +6,5 @@ resources:
 - sealed-secrets.yaml
 - immich-sync.yaml
 - immichframe.yaml
+- metallb-project.yaml
+- metallb.yaml
diff --git a/bootstrap/metallb-project.yaml b/bootstrap/metallb-project.yaml
new file mode 100644
index 0000000..8c12e24
--- /dev/null
+++ b/bootstrap/metallb-project.yaml
@@ -0,0 +1,44 @@
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: metallb
+  namespace: argocd
+spec:
+  description: MetalLB controller and site-specific L2 configuration
+  sourceRepos:
+  - https://code.brunner.ninja/feedc0de/homelab-gitops.git
+  destinations:
+  - namespace: metallb-system
+    server: https://kubernetes.default.svc
+  clusterResourceWhitelist:
+  - group: ""
+    kind: Namespace
+  - group: admissionregistration.k8s.io
+    kind: ValidatingWebhookConfiguration
+  - group: apiextensions.k8s.io
+    kind: CustomResourceDefinition
+  - group: rbac.authorization.k8s.io
+    kind: ClusterRole
+  - group: rbac.authorization.k8s.io
+    kind: ClusterRoleBinding
+  namespaceResourceWhitelist:
+  - group: ""
+    kind: ConfigMap
+  - group: ""
+    kind: Secret
+  - group: ""
+    kind: Service
+  - group: ""
+    kind: ServiceAccount
+  - group: apps
+    kind: DaemonSet
+  - group: apps
+    kind: Deployment
+  - group: metallb.io
+    kind: IPAddressPool
+  - group: metallb.io
+    kind: L2Advertisement
+  - group: rbac.authorization.k8s.io
+    kind: Role
+  - group: rbac.authorization.k8s.io
+    kind: RoleBinding
diff --git a/bootstrap/metallb.yaml b/bootstrap/metallb.yaml
new file mode 100644
index 0000000..8527c66
--- /dev/null
+++ b/bootstrap/metallb.yaml
@@ -0,0 +1,33 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: metallb
+  namespace: argocd
+spec:
+  project: metallb
+  source:
+    repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    path: apps/metallb
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: metallb-system
+  ignoreDifferences:
+  - group: ""
+    kind: Secret
+    name: metallb-webhook-cert
+    namespace: metallb-system
+    jsonPointers:
+    - /data
+  - group: admissionregistration.k8s.io
+    kind: ValidatingWebhookConfiguration
+    name: metallb-webhook-configuration
+    jqPathExpressions:
+    - .webhooks[]?.clientConfig.caBundle
+  syncPolicy:
+    automated:
+      enabled: true
+      prune: false
+      selfHeal: true
+    syncOptions:
+    - RespectIgnoreDifferences=true