diff --git a/host_exporters/defaults/main.yml b/host_exporters/defaults/main.yml
index 66287a4..097829d 100644
--- a/host_exporters/defaults/main.yml
+++ b/host_exporters/defaults/main.yml
@@ -1,4 +1,8 @@
 ---
+# Address the node exporter binds to; empty = all addresses. For hosts without host_firewall: the NetBird
+# address keeps the port off the LAN, and the mesh ACL decides who reaches it.
+host_exporters_listen_address: ""
+
 # Adds prometheus-smartctl-exporter (trixie-backports) next to the node exporter
 # on hosts with physical disks.
 host_exporters_smart: false
diff --git a/host_exporters/tasks/main.yml b/host_exporters/tasks/main.yml
index 04d3aab..cb28fd2 100644
--- a/host_exporters/tasks/main.yml
+++ b/host_exporters/tasks/main.yml
@@ -1,5 +1,6 @@
 ---
-# Both exporters listen on all addresses; host_firewall limits who reaches them.
+# Both exporters listen on all addresses (the node exporter on host_exporters_listen_address if set); host_firewall
+# limits who reaches them.
 # Its recommends (smartmontools, nvme-cli, ipmitool) start units that fail on hosts without such hardware.
 - name: Install the node exporter
   ansible.builtin.apt:
@@ -7,11 +8,44 @@
     install_recommends: false
     state: present
 
+- name: Bind the node exporter to one address
+  ansible.builtin.lineinfile:
+    path: /etc/default/prometheus-node-exporter
+    regexp: '^ARGS='
+    line: 'ARGS="--web.listen-address={{ host_exporters_listen_address }}:9100"'
+  when: host_exporters_listen_address | length > 0
+  register: host_exporters_listen
+  # Check mode does not install the package.
+  ignore_errors: "{{ ansible_check_mode }}"
+
+- name: Create the node exporter unit drop-in directory
+  ansible.builtin.file:
+    path: /etc/systemd/system/prometheus-node-exporter.service.d
+    state: directory
+    mode: "0755"
+  when: host_exporters_listen_address | length > 0
+
+# The NetBird address exists only after the daemon is up, and a failed bind must not exhaust the start limit.
+- name: Start the bound node exporter after NetBird and retry
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/prometheus-node-exporter.service.d/listen-address.conf
+    mode: "0644"
+    content: |
+      [Unit]
+      After=netbird.service
+      StartLimitIntervalSec=0
+
+      [Service]
+      RestartSec=5s
+  when: host_exporters_listen_address | length > 0
+  register: host_exporters_listen_unit
+
 - name: Enable the node exporter
   ansible.builtin.systemd:
     name: prometheus-node-exporter
     enabled: true
-    state: started
+    state: "{{ 'restarted' if (host_exporters_listen.changed or host_exporters_listen_unit.changed) else 'started' }}"
+    daemon_reload: "{{ host_exporters_listen_unit.changed }}"
   # Check mode does not install the package.
   ignore_errors: "{{ ansible_check_mode }}"