diff --git a/machines/liminix/ap01/addresses.nix b/machines/liminix/ap01/addresses.nix
index b3d0840..4f335d6 100644
--- a/machines/liminix/ap01/addresses.nix
+++ b/machines/liminix/ap01/addresses.nix
@@ -3,16 +3,18 @@ let
   svc = config.system.service;
 in
 {
-  services.dhcpv4 = svc.network.dhcp.client.build {
-    interface = config.services.int;
+  services.init-dhcpv4 = svc.network.dhcp.client.build {
+    interface = config.services.default-vlan;
     dependencies = [
       config.services.bridge.components.lan
     ];
   };
 
-  services.defaultroute4 = svc.network.route.build {
-    via = "$(output ${config.services.dhcpv4} router)";
+  services.init-defaultroute4 = svc.network.route.build {
+    via = "$(output ${config.services.init-dhcpv4} router)";
     target = "default";
-    dependencies = [ config.services.dhcpv4 ];
+    dependencies = [ config.services.init-dhcpv4 ];
   };
+
+  # TODO: ensure SLAAC for admin-vlan.
 }
diff --git a/machines/liminix/ap01/dns.nix b/machines/liminix/ap01/dns.nix
index d8346f8..0cbe3f6 100644
--- a/machines/liminix/ap01/dns.nix
+++ b/machines/liminix/ap01/dns.nix
@@ -8,17 +8,18 @@ in
   # TODO: support dynamic reconfiguration once we are in the target VLAN?
   services.resolvconf = oneshot rec {
     name = "resolvconf";
+    # TODO: imho, DNS should be static and provided by the router?
     up = ''
       . ${serviceFns}
       ( in_outputs ${name}
-      for i in $(output ${config.services.dhcpv4} dns); do
+      for i in $(output ${config.services.init-dhcpv4} dns); do
         echo "nameserver $i" >> resolv.conf
       done
       )
     '';
 
     dependencies = [
-      config.services.dhcpv4
+      config.services.init-dhcpv4
     ];
   };
 
diff --git a/machines/liminix/ap01/lan.nix b/machines/liminix/ap01/lan.nix
index 4916706..50603bf 100644
--- a/machines/liminix/ap01/lan.nix
+++ b/machines/liminix/ap01/lan.nix
@@ -3,37 +3,37 @@ let
   svc = config.system.service;
 in
 {
-  services.int = svc.bridge.primary.build {
-    ifname = "int";
-    macAddressFromInterface = config.hardware.networkInterfaces.lan;
-  };
-
-  services.bridge = svc.bridge.members.build {
-    primary = config.services.int;
-    members = {
-      lan.member = config.hardware.networkInterfaces.lan;
-      wlan0 = {
-        member = config.hardware.networkInterfaces.wlan0;
-        # Bridge only once hostapd is ready.
-        dependencies = [ config.services.hostap-1-ready ];
-      };
-      wlan1 = {
-        member = config.hardware.networkInterfaces.wlan1;
-        # Bridge only once hostapd is ready.
-        dependencies = [ config.services.hostap-2-ready ];
+  services = {
+    int = svc.bridge.primary.build {
+      ifname = "int";
+      macAddressFromInterface = config.hardware.networkInterfaces.lan;
+    };
+    bridge = svc.bridge.members.build {
+      primary = config.services.int;
+      members = {
+        lan.member = config.hardware.networkInterfaces.lan;
+        wlan0 = {
+          member = config.hardware.networkInterfaces.wlan0;
+          # Bridge only once hostapd is ready.
+          dependencies = [ config.services.hostap-1-ready ];
+        };
+        wlan1 = {
+          member = config.hardware.networkInterfaces.wlan1;
+          # Bridge only once hostapd is ready.
+          dependencies = [ config.services.hostap-2-ready ];
+        };
       };
     };
+    default-vlan = svc.vlan.build {
+      ifname = "apinit";
+      primary = config.services.int;
+      vid = "0";
+    };
+
+    admin-vlan = svc.vlan.build {
+      ifname = "admin";
+      primary = config.services.int;
+      vid = "3001";
+    };
   };
-
-  # Default VLAN
-  # services.vlan-apro = svc.vlan.build {
-  #   vlanId = 0;
-  #   interface = config.services.int;
-  # };
-
-  # # Administration VLAN
-  # services.vlan-admin = svc.vlan.build {
-  #   vlan = 3001;
-  #   interface = config.services.int;
-  # };
 }