diff --git a/core/archipelago/src/bootstrap.rs b/core/archipelago/src/bootstrap.rs
index f071b4b5..18c41109 100644
--- a/core/archipelago/src/bootstrap.rs
+++ b/core/archipelago/src/bootstrap.rs
@@ -991,6 +991,13 @@ async fn patch_nginx_conf(path: &str) -> Result<bool> {
     // B13: fedimint block present but lacking the asset-rewrite sub_filters.
     let needs_fedimint_css = content.contains("location /app/fedimint/")
         && !content.contains("'href=\"/' 'href=\"/app/fedimint/'");
+    // Companion mesh access: phones reach this node over FIPS at its fips0
+    // ULA (http://[fdxx:…]). Configs shipped before 2026-07-23 listened on
+    // IPv4 only, so the ULA could never connect — nothing answered [::]:80.
+    let missing_v6_http = content.contains("listen 80 default_server;")
+        && !content.contains("listen [::]:80");
+    let missing_v6_https = content.contains("listen 443 ssl default_server;")
+        && !content.contains("listen [::]:443");
     if !missing_app_catalog
         && !missing_bitcoin_status
         && !missing_lnd_proxy
@@ -998,12 +1005,27 @@ async fn patch_nginx_conf(path: &str) -> Result<bool> {
         && !missing_pine_status
         && !has_lnd_dup_cors
         && !needs_fedimint_css
+        && !missing_v6_http
+        && !missing_v6_https
     {
         return Ok(false);
     }
 
     let mut patched = content.clone();
 
+    if missing_v6_http {
+        patched = patched.replace(
+            "listen 80 default_server;",
+            "listen 80 default_server;\n    listen [::]:80 default_server;",
+        );
+    }
+    if missing_v6_https {
+        patched = patched.replace(
+            "listen 443 ssl default_server;",
+            "listen 443 ssl default_server;\n    listen [::]:443 ssl default_server;",
+        );
+    }
+
     if has_lnd_dup_cors {
         // Drop the redundant nginx-side CORS headers so the backend's single
         // validated Access-Control-Allow-Origin is the only one returned.
diff --git a/image-recipe/configs/nginx-archipelago.conf b/image-recipe/configs/nginx-archipelago.conf
index ecc7b154..c908eb82 100644
--- a/image-recipe/configs/nginx-archipelago.conf
+++ b/image-recipe/configs/nginx-archipelago.conf
@@ -9,6 +9,10 @@ resolver_timeout 5s;
 
 server {
     listen 80 default_server;
+    # IPv6 listener is REQUIRED: companion phones reach this node over the
+    # FIPS mesh at its fips0 ULA (http://[fdxx:…]) — without [::]:80 that
+    # address can never connect (found live 2026-07-23, framework-pt).
+    listen [::]:80 default_server;
     server_name _;
 
     root /opt/archipelago/web-ui;
@@ -901,6 +905,7 @@ server {
 # HTTPS - required for PWA install (Add to Home Screen) from dev servers
 server {
     listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;
     server_name _;
 
     ssl_certificate /etc/archipelago/ssl/archipelago.crt;