diff --git a/opentofu/vr1-dc0-substrate/main.tf b/opentofu/vr1-dc0-substrate/main.tf
index 632da6c..4868b35 100644
--- a/opentofu/vr1-dc0-substrate/main.tf
+++ b/opentofu/vr1-dc0-substrate/main.tf
@@ -160,6 +160,41 @@
       "52:54:00:48:e7:1e", "52:54:00:ed:cd:74", "52:54:00:0f:ee:3a",
     "52:54:00:b0:1e:dd", "52:54:00:24:26:0a", "52:54:00:00:a1:37"] }
 
+    # ---- D-132 AMENDMENT ADDENDUM (RULED 2026-07-30): the DEDICATED per-DC MAAS REGION.
+    # Operator utterance: "Dedicated region VM per DC at utility .6 (Recommended)".
+    # NOT a D-121 role node and NOT the Juju controller -- the 9 OpenStack nodes and the
+    # D-104 controller above are unchanged. `for_each` is keyed, so this plans 1 add /
+    # 0 change / 0 destroy.
+    #
+    # WHY IT EXISTS: `jujud` runs ON the in-DC Juju controller and dials the MAAS region
+    # API for its whole life. With the region at Office1 that dependency had to cross the
+    # fiber, which SEC-010's transit FORWARD-drop forbids -- MEASURED as
+    # `ERROR creating MAAS environ: ... 10.10.0.20:5240: connect: connection refused` on
+    # the 2026-07-30 bootstrap. A DC-local region REMOVES the requirement instead of
+    # excepting it, which is why SEC-010 stays UNAMENDED.
+    #
+    # SIZING: 4 vCPU / 8 GiB are the values the capacity gate actually modelled
+    # (`scripts/dc-dc-whole-host-budget.py --containment-overhead-mem-gib 32
+    # --containment-overhead-vcpu 12` -> RAM 870/1024 = 85 pct, FIT, 154 GiB headroom).
+    # Disk 150 GiB, not the controller's 100: this VM stores the region's PostgreSQL AND
+    # its boot-image set (jammy + noble are both synced today), so it is the one utility
+    # VM whose disk grows with the image catalogue.
+    #
+    # MACs DELIBERATELY EMPTY -- correct ONLY before the VM is enlisted anywhere, which is
+    # its state at first apply. PIN THEM FROM MEASUREMENT (`virsh domiflist`) immediately
+    # after that apply, exactly as the nine role nodes were on 2026-07-21 and the Juju
+    # controller was on 2026-07-29. Leaving them unpinned past enlistment is the
+    # MAC-regeneration trap that stranded the whole fleet once already.
+    #
+    # ADDRESSING: utility-band `.6` on every plane it is attached to (D-134's octet map,
+    # extended by the same 2026-07-30 ruling: .4 artifact service / .5 Juju controller /
+    # .6 MAAS region -- a STANDING cross-DC standard, so divergence is a DEFECT).
+    # CARVE BOTH metal-admin (10.12.8.6) AND provider-public (10.12.4.6, gw 10.12.4.1) at
+    # enlistment. The region needs egress for image sync, and carving metal-admin ALONE is
+    # exactly the under-carve that cost three bootstrap attempts on the controller VM the
+    # same day -- it has no default route and cannot reach the internet.
+    "vr1-dc0-maas-01" = { vcpu = 4, mem = 8192, disk_gib = 150, macs = [] }
+
   }
 }
 
diff --git a/opentofu/vr1-dc1-substrate/main.tf b/opentofu/vr1-dc1-substrate/main.tf
index e182720..9bef530 100644
--- a/opentofu/vr1-dc1-substrate/main.tf
+++ b/opentofu/vr1-dc1-substrate/main.tf
@@ -163,6 +163,28 @@
       "52:54:00:53:12:70", "52:54:00:3e:1a:f2", "52:54:00:e1:4c:d5",
     "52:54:00:fe:ae:80", "52:54:00:e2:eb:41", "52:54:00:55:32:e1"] }
 
+    # ---- D-132 AMENDMENT ADDENDUM (RULED 2026-07-30): the DEDICATED per-DC MAAS REGION.
+    # The dc1 twin of `vr1-dc0-maas-01`; see that entry's comment for the full rationale.
+    # Operator utterance: "Dedicated region VM per DC at utility .6 (Recommended)".
+    # `for_each` is keyed, so this plans 1 add / 0 change / 0 destroy.
+    #
+    # IDENTICAL SIZING TO dc0 BY DESIGN. The D-134 octet map is a STANDING CROSS-DC
+    # STANDARD and divergence between the DCs at the same octet is a DEFECT, not a local
+    # choice -- so this VM is the same 4 vCPU / 8 GiB / 150 GiB shape as dc0's, and takes
+    # utility-band `.6` on every plane it is attached to.
+    #
+    # MACs DELIBERATELY EMPTY at first apply, then PINNED FROM MEASUREMENT -- same rule as
+    # every other node here. NOTE the dc1 fleet's schematic `52:54:01:d1:NN:PP` MACs do
+    # NOT apply to this VM or to `vr1-dc1-juju-01`: both were authored with `macs = []`
+    # and therefore carry libvirt-generated `52:54:00:` values. Recorded so the difference
+    # is not later read as a defect.
+    #
+    # CARVE BOTH metal-admin (10.12.68.6) AND provider-public (10.12.64.6, gw 10.12.64.1)
+    # at enlistment -- the region needs egress for image sync, and metal-admin alone leaves
+    # it with no default route (the under-carve that cost three bootstrap attempts on the
+    # dc0 controller VM on 2026-07-30).
+    "vr1-dc1-maas-01" = { vcpu = 4, mem = 8192, disk_gib = 150, macs = [] }
+
   }
 }