diff --git a/cmd/hepto/hepto.go b/cmd/hepto/hepto.go
index 42b9a7555bfae9322ab346f287c9399ad0b47cb5..84874c7f1937d2c33dfe17a47549bfeed19541ad 100644
--- a/cmd/hepto/hepto.go
+++ b/cmd/hepto/hepto.go
@@ -68,7 +68,7 @@ func Hepto() error {
 	if config.Node.Role == "master" || config.Node.Role == "full" {
 		c.Add(&dolly.Forward{
 			From: netip.AddrPortFrom(netip.MustParseAddr("::1"), uint16(config.Cluster.LoopbackPort)),
-			To:   netip.AddrPortFrom(netip.MustParseAddr("::1"), 6443),
+			To:   netip.AddrPortFrom(manager.State.Networking().NodeAddress.Addr(), 6443),
 		})
 	}
 	return c.Run(func() error {
diff --git a/services/apiserver.go b/services/apiserver.go
index 00d8b2c597f75968ba4f95215c36a10f5e7552eb..6d21fed5de0950fa3b3c9593bacdfdd11bff4cfc 100644
--- a/services/apiserver.go
+++ b/services/apiserver.go
@@ -158,9 +158,7 @@ func buildConfig(c *Cluster) (config *server.Config, clients *k8s.Clients, err e
 	)
 
 	// Setup listener
-	// TODO listen on management interface only, this is temporary so that the api is reachable on
-	// localhost
-	listener, err := net.Listen("tcp6", fmt.Sprintf("[%s]:%d", "::", apiserverPort))
+	listener, err := net.Listen("tcp6", fmt.Sprintf("[%s]:%d", c.networking.NodeAddress.Addr().String(), apiserverPort))
 	if err != nil {
 		err = fmt.Errorf("could not initialize listener: %w", err)
 		return