diff --git a/main.tf b/main.tf
index 93fdaf5..935ec28 100644
--- a/main.tf
+++ b/main.tf
@@ -16,6 +16,7 @@ locals {
   ])
 
   technitium_enabled = try(data.external.infisical.result["technitium_api_token"], "") != ""
+  ipam_enabled       = try(data.external.infisical.result["ipam_username"], "") != ""
 
   # Shared inputs passed to every proxmox_node module call.
   node_common = {
@@ -82,6 +83,15 @@ locals {
   }
 }
 
+# Uncomment when phpIPAM is running and credentials are in Infisical.
+# module "phpipam" {
+#   source = "./opentofu/modules/phpipam"
+#
+#   enabled         = local.ipam_enabled
+#   hosts           = local.all_declared_hosts
+#   network_subnets = var.network_subnets
+# }
+
 module "technitium" {
   source = "./opentofu/modules/technitium"
 
diff --git a/opentofu b/opentofu
index af1d02b..555e446 160000
--- a/opentofu
+++ b/opentofu
@@ -1 +1 @@
-Subproject commit af1d02b9b25b6398bbdb97a35352318b6c05e524
+Subproject commit 555e4466914182f5ee1f6ea5e833718b5830f291
diff --git a/providers.tf b/providers.tf
index 9840336..489ba32 100644
--- a/providers.tf
+++ b/providers.tf
@@ -12,6 +12,10 @@ terraform {
       source  = "kenske/technitium"
       version = "~> 0.2"
     }
+    # phpipam = {
+    #   source  = "lord-kyron/phpipam"
+    #   version = "1.6.2"
+    # }
   }
 }
 
@@ -27,6 +31,16 @@ data "external" "infisical" {
   program = ["bash", "-c", "infisical export --template=./secrets.tmpl"]
 }
 
+# Uncomment when phpIPAM is running and credentials are in Infisical.
+# provider "phpipam" {
+#   app_id             = "tofu"
+#   endpoint           = var.ipam_endpoint
+#   username           = coalesce(try(data.external.infisical.result["ipam_username"], ""), "user-not-yet-provisioned")
+#   password           = coalesce(try(data.external.infisical.result["ipam_password"], ""), "pass-not-yet-provisioned")
+#   insecure           = false
+#   nest_custom_fields = false
+# }
+
 provider "proxmox" {
   alias               = "proxmox"
   pm_api_url          = var.hypervisors["proxmox"].api_url
diff --git a/terraform.tfvars b/terraform.tfvars
index b73b4b4..855c7b6 100644
--- a/terraform.tfvars
+++ b/terraform.tfvars
@@ -8,7 +8,6 @@ hypervisors = {
   }
 }
 
-enable_ipam   = false
 ipam_endpoint = "https://ipam.example.net/api"
 
 network_subnets = {
@@ -39,7 +38,7 @@ dns_records = [
   { zone = "oswaldtheotter.lan", name = "omada", type = "A",     value = "192.168.0.110" },
   { zone = "oswaldtheotter.lan", name = "portanas", type = "A",     value = "192.168.0.4" },
   { zone = "oswaldtheotter.lan", name = "proxmox", type = "A",     value = "192.168.0.240" },
-  { zone = "oswaldtheotter.lan", name = "nas",    type = "CNAME", value = "portanas.lan.oswaldtheotter.net" },
+  { zone = "oswaldtheotter.lan", name = "nas",    type = "CNAME", value = "portanas.oswaldtheotter.lan" },
 ]
 
 # ── Node definitions ───────────────────────────────────────────────────────────
diff --git a/vars.tf b/vars.tf
index 1de7430..9ad3ec0 100644
--- a/vars.tf
+++ b/vars.tf
@@ -7,12 +7,6 @@ variable "hypervisors" {
   }))
 }
 
-variable "enable_ipam" {
-  description = "When true, register all IPs in PHPIPAM. Requires ipam_endpoint and IPAM credentials in Infisical."
-  type        = bool
-  default     = false
-}
-
 variable "ipam_endpoint" {
   description = "Base URL of the PHPIPAM API, e.g. https://ipam.example.com/api"
   type        = string