diff --git a/docs/changelog.md b/docs/changelog.md
index a80ba8dd..3936f5c2 100644
--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -19,6 +19,22 @@ docstring gives: it is a record, not a claim about now.
 
 ## 2026-11-09
 
+- **`tpl-kali`'s build now removes its own eth0 DHCP stanza before
+  templating.** The preseed writes `/etc/network/interfaces.d/eth0` so the
+  build has a network ([#790](https://github.com/Gerrrt/HomeLab/issues/790)),
+  and its comment said a clone's cloud-init configured its network on top.
+  That was wrong for a static clone. On `gandalf`, a throwaway clone of 902
+  at `172.30.30.199` on `vmbr1` raised both that stanza and cloud-init's
+  static one. dhcpcd got no lease, fell back to `169.254.x.x`, added
+  `default dev eth0 scope link`, and failed `build-the-playground.md` §8
+  check four ([#421](https://github.com/Gerrrt/HomeLab/issues/421)).
+  `packer/kali.pkr.hcl`'s first provisioner now deletes the file beside
+  `cloud-init clean`, for 902 and 910 alike. The installer's `ens18` stanza
+  stays, because no `ens18` exists on Kali. `packer-smoke.sh`,
+  `make-attack-vm.sh` and `garuda`'s module all set `ipconfig0` to DHCP, so
+  their `eth0` still comes up through cloud-init. Neither template has been
+  rebuilt with the change yet; until it is, both still carry the stanza.
+
 - **ADR-0089's trigger 3 has fired: Wiki.js 3.x is stable, and the move is
   [#1339](https://github.com/Gerrrt/HomeLab/issues/1339).** `requarks/wiki`
   published `3.0.1`, its first stable 3.x release, on 2026-11-01. Five more
diff --git a/docs/runbooks/build-the-lab-templates.md b/docs/runbooks/build-the-lab-templates.md
index 270c566a..b286917a 100644
--- a/docs/runbooks/build-the-lab-templates.md
+++ b/docs/runbooks/build-the-lab-templates.md
@@ -496,6 +496,15 @@ not from a second disc.
 > with 0 failed units and no account expiring at the epoch, the check
 > [#1196](https://github.com/Gerrrt/HomeLab/issues/1196) owed 902.
 
+The preseed writes `/etc/network/interfaces.d/eth0`, a DHCP stanza, so the
+build has a network. The build's first provisioner deletes it before
+templating, so a clone's network is only what cloud-init writes from its
+`ipconfigN`. A template built before that change still holds the stanza. A
+static-only clone of one raises DHCP beside its static address, and with no
+DHCP server dhcpcd adds a `169.254.x.x` address and a link-local default
+route ([`build-the-playground.md`](build-the-playground.md) §8). Rebuild 902
+and 910 with this section and §5b to clear it.
+
 1. Admit the guest to that port on `phoenix` for the length of the build. If
    `ufw` is active, run `sudo ufw allow from 10.0.30.0/24 to any port 8800 proto tcp`,
    and delete the rule afterwards. Debian's build (§4) needs this step and
diff --git a/packer/kali.pkr.hcl b/packer/kali.pkr.hcl
index 2d148f67..20044d38 100644
--- a/packer/kali.pkr.hcl
+++ b/packer/kali.pkr.hcl
@@ -241,6 +241,18 @@ build {
       "ln -sf /dev/null /etc/systemd/system-generators/systemd-sslh-generator",
       "ln -sf /usr/lib/systemd/system/cloud-init.target /etc/systemd/system/multi-user.target.wants/cloud-init.target",
       "apt-get clean",
+      # The preseed's eth0 DHCP stanza is the build's network only. Left in
+      # the template, ifupdown raised it beside cloud-init's static stanza on
+      # a static-only clone, dhcpcd got no lease on vmbr1, fell back to
+      # 169.254.x.x and added `default dev eth0 scope link`: a target with a
+      # default route, which build-the-playground.md §8 check four fails
+      # (found 2026-11-09 on gandalf, a throwaway clone of 902). Every clone
+      # gets a NoCloud drive, so cloud-init writes each NIC's stanza, DHCP
+      # included. Removing the file does not take down the running build's
+      # eth0. The installer's ens18 stanza in /etc/network/interfaces stays:
+      # no ens18 exists on Kali (eth0 naming, see the preseed), so ifupdown
+      # never raises it.
+      "rm -f /etc/network/interfaces.d/eth0",
       "rm -f /etc/ssh/ssh_host_*",
       "cloud-init clean --logs --machine-id",
     ]
diff --git a/packer/kali/preseed.cfg.pkrtpl b/packer/kali/preseed.cfg.pkrtpl
index 5fa96865..b2083fbb 100644
--- a/packer/kali/preseed.cfg.pkrtpl
+++ b/packer/kali/preseed.cfg.pkrtpl
@@ -73,7 +73,10 @@ d-i grub-installer/bootdev string default
 # it. With only an ens18 stanza, eth0 never came up, the guest had no address, and
 # Packer timed out waiting for SSH (#790, two proof builds on Saruman, 2026-10-08).
 # interfaces sources interfaces.d, so this adds eth0 without editing the
-# installer's file. A clone's cloud-init configures its own network on top.
+# installer's file. It is the build's network only: kali.pkr.hcl's first
+# provisioner removes it before templating, because a clone that kept it raised
+# DHCP beside cloud-init's static stanza and got a link-local default route.
+# A clone's network is cloud-init's alone.
 #
 # The chage loop clears a bogus account-expiry (shadow field 8 == 1, i.e. the
 # epoch, 1970-01-02) that Kali's package postinsts leave on service accounts