diff --git a/app/sovran_systemsos_web/server.py b/app/sovran_systemsos_web/server.py
index 0b4b474..f189f19 100644
--- a/app/sovran_systemsos_web/server.py
+++ b/app/sovran_systemsos_web/server.py
@@ -4535,18 +4535,22 @@ def _run_njalla_ddns() -> None:
     if not urls:
         return
     # Resolve current public IP (best-effort; skip if unavailable)
+    public_ip = ""
     try:
         ip_result = subprocess.run(
             ["dig", "@resolver4.opendns.com", "myip.opendns.com", "+short", "-4"],
             capture_output=True, text=True, timeout=10, check=False,
         )
-        public_ip = ip_result.stdout.strip()
+        raw_ip = ip_result.stdout.strip().splitlines()[0] if ip_result.stdout.strip() else ""
+        # Validate strictly as a proper IPv4/IPv6 address before substitution
+        ipaddress.ip_address(raw_ip)
+        public_ip = raw_ip
     except Exception:
         public_ip = ""
 
     for raw_url in urls:
         try:
-            # Replace the placeholder with the resolved IP (safe string replacement)
+            # Replace the placeholder with the validated IP (safe string replacement)
             url = raw_url.replace("${IP}", public_ip) if public_ip else raw_url
             subprocess.run(
                 ["curl", "--silent", "--max-time", "15", "--fail", url],
diff --git a/modules/core/tech-support.nix b/modules/core/tech-support.nix
index f7ef9b2..83e2715 100644
--- a/modules/core/tech-support.nix
+++ b/modules/core/tech-support.nix
@@ -61,6 +61,14 @@
         { command = "/run/current-system/sw/bin/systemctl status bitcoind.service";     options = [ "NOPASSWD" ]; }
         { command = "/run/current-system/sw/bin/systemctl status lnd.service";          options = [ "NOPASSWD" ]; }
         { command = "/run/current-system/sw/bin/journalctl *";                          options = [ "NOPASSWD" ]; }
+        # NOTE: journalctl with arbitrary flags is retained to allow support
+        # staff to filter logs by unit, time-range, and priority during
+        # diagnostics.  The --file / --directory flags could theoretically
+        # allow reading arbitrary log files, but the support user already has
+        # read access to /var/log as a system user.  Wallet and secret files
+        # are not stored in journald format, so exposure is limited to
+        # operational logs.  Consider restricting to specific units if a
+        # narrower support workflow is defined in a future release.
       ];
     }
   ];