diff --git a/ansible/readme.md b/ansible/readme.md
index cdae033..60179fd 100644
--- a/ansible/readme.md
+++ b/ansible/readme.md
@@ -52,10 +52,9 @@ machine's `~/.ssh/config` says. (`ssh` on some machines complains about
 a local file-permission bug whose fix is `sudo chown -R root:root
 /etc/ssh/ssh_config.d`, not something this playbook works around.)
 
-Adding a Site is one line in `hosts`, a copy of `vars/hopsngrains.yml`, a
-`config/<site>.site.json`, and a **free subnet** — this host's Docker address
-pools are exhausted, so `network_subnet` (a free `/24` from `10.210.0.0/16`) is
-required and a network is only created with it.
+Adding a Site is one line in `hosts`, a copy of `vars/hopsngrains.yml`, and a
+`config/<site>.site.json`. The image is shared, so the config has to be in it:
+a new Site needs a new tag.
 
 ## Checking it landed
 
diff --git a/ansible/roles/network/tasks/main.yaml b/ansible/roles/network/tasks/main.yaml
index 3f16862..979dde4 100644
--- a/ansible/roles/network/tasks/main.yaml
+++ b/ansible/roles/network/tasks/main.yaml
@@ -1,29 +1,5 @@
 ---
-- name: Look for the app network
-  docker_network_info:
-    name: '{{ docker_network }}'
-  register: menu_network
-
-- name: Fail when this Site declares no subnet
-  fail:
-    msg: >-
-      {{ inventory_hostname }} needs a network_subnet in its vars file. This host's
-      default address pools are exhausted (every 172.17-172.30/16 and every
-      192.168.0-240/20 is taken), so Docker refuses to allocate one and a network
-      has to be created with an explicit subnet.
-  when: network_subnet | default('') == ''
-
-# An existing network is left exactly as it is: Docker cannot change a network's
-# subnet in place, and the Sites already running have theirs.
-- name: Create the app network with this Site's subnet
-  docker_network:
-    name: '{{ docker_network }}'
-    ipam_config:
-      - subnet: '{{ network_subnet }}'
-    state: present
-  when: not menu_network.exists
-
-- name: Put Caddy on the app network
+- name: 'Ensure {{ docker_network }} exists and Caddy is on it'
   docker_network:
     name: '{{ docker_network }}'
     state: present
diff --git a/ansible/vars/default.yml b/ansible/vars/default.yml
index 2e78a5a..ab4ba28 100644
--- a/ansible/vars/default.yml
+++ b/ansible/vars/default.yml
@@ -8,9 +8,6 @@ site: '{{ inventory_hostname }}'
 image_name: registry.tanshu.com/menu-admin
 image_tag: "{{ tag | default('latest') }}"
 
-# Every Site sets network_subnet: the host's Docker address pools are exhausted,
-# so a network created without an explicit subnet is refused. Use a free /24 from
-# 10.210.0.0/16, one per Site.
 app_uid: 1000
 app_gid: 1000
 
diff --git a/ansible/vars/greatbear.yml b/ansible/vars/greatbear.yml
index f1100f6..96aa27c 100644
--- a/ansible/vars/greatbear.yml
+++ b/ansible/vars/greatbear.yml
@@ -11,7 +11,3 @@ docker_network: '{{ docker_container }}_net'
 # Everything the app writes — data/ and the untracked site.env. Deliberately the
 # directory the old static menus were served from.
 app_root: '/var/lib/{{ host }}'
-
-# The host's default Docker pools are exhausted, so every Site names a subnet.
-# This one already exists from the pool; the value is what a rebuild would use.
-network_subnet: 10.210.2.0/24
diff --git a/ansible/vars/hngmohali.yml b/ansible/vars/hngmohali.yml
index 91e4f49..986b0d3 100644
--- a/ansible/vars/hngmohali.yml
+++ b/ansible/vars/hngmohali.yml
@@ -11,6 +11,3 @@ docker_network: '{{ docker_container }}_net'
 # Everything the app writes — data/ and the untracked site.env. Deliberately the
 # directory the old static menus were served from.
 app_root: '/var/lib/{{ host }}'
-
-# The host's default Docker pools are exhausted, so every Site names a subnet.
-network_subnet: 10.210.3.0/24
diff --git a/ansible/vars/hopsngrains.yml b/ansible/vars/hopsngrains.yml
index 7858107..4ee10c7 100644
--- a/ansible/vars/hopsngrains.yml
+++ b/ansible/vars/hopsngrains.yml
@@ -19,7 +19,3 @@ docker_network: '{{ docker_container }}_net'
 # writes its own data/ inside it; the old menu files can be emptied out when
 # they are no longer wanted, and the directory itself must stay.
 app_root: '/var/lib/{{ host }}'
-
-# The host's default Docker pools are exhausted, so every Site names a subnet.
-# This one already exists from the pool; the value is what a rebuild would use.
-network_subnet: 10.210.1.0/24
diff --git a/test/site-configs.test.ts b/test/site-configs.test.ts
index 5df66ec..cd703cd 100644
--- a/test/site-configs.test.ts
+++ b/test/site-configs.test.ts
@@ -52,8 +52,6 @@ describe('every Site in the inventory is complete', () => {
       assert.match(varsRaw, /^title: /m, `${name}: ${varFile} has no title`);
       assert.match(varsRaw, /^host: 'menu\.\{\{ title \}\}'/m, `${name}: host is not quoted`);
       assert.match(varsRaw, /^app_root: /m, `${name}: no app_root`);
-      // Without this the play fails on a host whose Docker pools are full.
-      assert.match(varsRaw, /^network_subnet: /m, `${name}: no network_subnet`);
     }
   });