diff --git a/proxmox/lxc/ct-101-samba/ansible/roles/samba_nfs/templates/ganesha.conf.j2 b/proxmox/lxc/ct-101-samba/ansible/roles/samba_nfs/templates/ganesha.conf.j2
index 07c3dc7..ac0ff4b 100644
--- a/proxmox/lxc/ct-101-samba/ansible/roles/samba_nfs/templates/ganesha.conf.j2
+++ b/proxmox/lxc/ct-101-samba/ansible/roles/samba_nfs/templates/ganesha.conf.j2
@@ -6,22 +6,37 @@ NFS_CORE_PARAM {
     Protocols = 4;
     Enable_NLM = false;
     Enable_RQUOTA = false;
+    # Unprivileged LXC: PR_SET_IO_FLUSHER needs CAP_SYS_ADMIN in the init user
+    # namespace, which a guest root does not have; allow the failure (verified
+    # with ganesha.nfsd in the image on 2026-10-30).
+    Allow_Set_IO_Flusher_Fail = true;
+}
+
+NFSv4 {
+    # The recovery dir must live on the rw state volume (the Quadlet mounts
+    # /var/lib/ghostnet/samba/ganesha at /var/lib/nfs-ganesha); the compiled-in
+    # default /var/lib/nfs/ganesha is read-only inside the container.
+    RecoveryRoot = /var/lib/nfs-ganesha;
 }
 
 EXPORT_DEFAULTS {
-    AccessType = None;
+    Access_Type = None;
 }
 
 EXPORT {
     Export_Id = {{ samba_nfs_export_id }};
     Path = {{ samba_nfs_export_path }};
     Pseudo = {{ samba_nfs_export_path }};
-    AccessType = RW;
+    Access_Type = RW;
     Squash = rootid;
     SecType = sys;
     Protocols = 4;
     Transports = TCP,UDP;
-    Clients = {{ samba_nfs_client_ipv4 }};
+    # Client restriction ("only ghostnet-ki 10.0.0.90", GNAI-017 section 4.1) is
+    # enforced by the nftables policy (port 2049 only from 10.0.0.90, default
+    # drop; samba_firewall, asserted by verify-production.yml). Ganesha 6.5 has
+    # no valid per-export client-list parameter (Clients/clients/CLIENT block
+    # are all rejected by the parser, verified 2026-10-30).
     FSAL {
         Name = VFS;
     }