diff --git a/opentofu/modules/wan-bridge/main.tf b/opentofu/modules/wan-bridge/main.tf
index 699a1b1..c6e11b7 100644
--- a/opentofu/modules/wan-bridge/main.tf
+++ b/opentofu/modules/wan-bridge/main.tf
@@ -25,7 +25,10 @@
     name = var.host_bridge
   }
 
-  mtu = {
-    size = var.mtu
-  }
+  # NO mtu block: libvirt REJECTS <mtu> in forward mode "bridge" ("mtu size only
+  # allowed in open, route, nat, and isolated mode" -- measured at the first real
+  # apply, 2026-07-20; the schema parses it but define fails, DOCFIX-194 class).
+  # Correct as well as necessary: on a bridge-mode network the MTU is a property
+  # of the underlying host bridge (br-vr1-dc0-wan, 1500 via the outer netplan),
+  # and guest interfaces inherit it from there.
 }
diff --git a/opentofu/modules/wan-bridge/variables.tf b/opentofu/modules/wan-bridge/variables.tf
index 30e0541..77bc8f4 100644
--- a/opentofu/modules/wan-bridge/variables.tf
+++ b/opentofu/modules/wan-bridge/variables.tf
@@ -33,8 +33,5 @@
   type        = string
 }
 
-variable "mtu" {
-  description = "WAN-segment MTU. Default 1500 (the ISP-uplink domain; NEVER jumbo -- matches site-wan)."
-  type        = number
-  default     = 1500
-}
+# (mtu variable REMOVED 2026-07-20: libvirt forbids <mtu> on bridge-mode networks
+# -- the segment MTU is the host bridge's own, 1500 via vvr1-dc0's netplan.)