diff --git a/roles/svc-net-wireguard-firewalled/README.md b/roles/svc-net-wireguard-firewalled/README.md
index 90d2eed027..8b42479c3a 100644
--- a/roles/svc-net-wireguard-firewalled/README.md
+++ b/roles/svc-net-wireguard-firewalled/README.md
@@ -8,7 +8,7 @@ This role adapts iptables rules to enable proper connectivity for a WireGuard cl
 
 Optimized for environments with network address translation (NAT), this role:
 
-- Executes shell commands to modify iptables rules.
+- Installs its iptables rules through Ansible's `iptables` module, so a redeploy converges instead of appending a duplicate.
 - Allows traffic from the WireGuard client interface (e.g. `wg0-client`) and sets up NAT masquerading on the external interface (e.g. `eth0`).
 - Works as an extension to the native WireGuard client role.
 
diff --git a/roles/svc-net-wireguard-firewalled/tasks/00_core.yml b/roles/svc-net-wireguard-firewalled/tasks/00_core.yml
index 0c08a0b925..7360c4dc21 100644
--- a/roles/svc-net-wireguard-firewalled/tasks/00_core.yml
+++ b/roles/svc-net-wireguard-firewalled/tasks/00_core.yml
@@ -1,5 +1,19 @@
 ---
-- name: 🔧 adapt iptable rules
-  shell: iptables -A FORWARD -i wg0-client -j ACCEPT && iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
+- name: "🧱 Accept forwarded traffic from the wireguard client"
+  become: true
+  ansible.builtin.iptables:
+    chain: FORWARD
+    in_interface: "{{ WIREGUARD_CLIENT_INTERFACE }}"
+    jump: ACCEPT
+    state: present
+
+- name: "🧱 Masquerade the client behind the uplink address"
+  become: true
+  ansible.builtin.iptables:
+    table: nat
+    chain: POSTROUTING
+    out_interface: "{{ WIREGUARD_UPLINK_INTERFACE }}"
+    jump: MASQUERADE
+    state: present
 
 - include_tasks: utils/once/flag.yml
diff --git a/roles/svc-net-wireguard-firewalled/vars/main.yml b/roles/svc-net-wireguard-firewalled/vars/main.yml
index 79d2e17b23..2cd2850160 100644
--- a/roles/svc-net-wireguard-firewalled/vars/main.yml
+++ b/roles/svc-net-wireguard-firewalled/vars/main.yml
@@ -1,2 +1,5 @@
 ---
 application_id: svc-net-wireguard-firewalled
+
+WIREGUARD_CLIENT_INTERFACE: wg0-client
+WIREGUARD_UPLINK_INTERFACE: eth0