diff --git a/scripts/pepsi/add-mail-v6-static.sh b/scripts/pepsi/add-mail-v6-static.sh
new file mode 100755
index 0000000..26b4014
--- /dev/null
+++ b/scripts/pepsi/add-mail-v6-static.sh
@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+# Add dedicated mail IPv6 on koopa eno1 (not Tor SLAAC).
+# Addr: 2a02:168:53a8::25/64  (hernani-dns KOOPA_WAN_AAAA)
+# Keeps ipv6.method=auto so SLAAC (Tor) stays. Adds one static address.
+# Freigabe: human this session. Run on koopa as root / sudo.
+# Live: ip -6 addr add; persist: nmcli connection modify +ipv6.addresses
+set -euo pipefail
+
+IFACE="${IFACE:-eno1}"
+ADDR="${MAIL_V6_ADDR:-2a02:168:53a8::25}"
+PREFIX="${MAIL_V6_PREFIX:-64}"
+CIDR="${ADDR}/${PREFIX}"
+CON="${NM_CON:-}"
+
+if [[ ${EUID:-$(id -u)} -ne 0 ]]; then
+  echo "STATUS=need_root HINT='sudo $0'"
+  exit 2
+fi
+
+echo "STATUS=start HOST=$(hostname -s) IFACE=$IFACE CIDR=$CIDR"
+
+if ! ip link show "$IFACE" >/dev/null 2>&1; then
+  echo "STATUS=no_iface IFACE=$IFACE"
+  exit 3
+fi
+
+# Resolve NM connection for IFACE if not set
+if [[ -z "$CON" ]]; then
+  CON=$(nmcli -g NAME,DEVICE con show --active 2>/dev/null \
+    | awk -F: -v d="$IFACE" '$2==d {print $1; exit}')
+  if [[ -z "$CON" ]]; then
+    CON=$(nmcli -g NAME,DEVICE con show 2>/dev/null \
+      | awk -F: -v d="$IFACE" '$2==d {print $1; exit}')
+  fi
+fi
+if [[ -z "$CON" ]]; then
+  CON="$IFACE"
+fi
+echo "NM_CON=$CON"
+
+# Idempotent live address
+if ip -6 addr show dev "$IFACE" | grep -qE "inet6[[:space:]]+${ADDR}/"; then
+  echo "LIVE=present ADDR=$ADDR"
+  LIVE_ADDED=0
+else
+  ip -6 addr add "$CIDR" dev "$IFACE"
+  echo "LIVE=added ADDR=$CIDR"
+  LIVE_ADDED=1
+fi
+
+# Persist via NetworkManager (append; do not replace method=auto)
+EXISTING=$(nmcli -g ipv6.addresses con show "$CON" 2>/dev/null || true)
+if echo "$EXISTING" | grep -qF "$ADDR"; then
+  echo "NM=present ADDR=$ADDR"
+  NM_ADDED=0
+else
+  nmcli con mod "$CON" +ipv6.addresses "$CIDR"
+  echo "NM=added ADDR=$CIDR"
+  NM_ADDED=1
+  # Apply without full down/up if possible
+  if nmcli con up "$CON" >/dev/null 2>&1; then
+    echo "NM=reapplied CON=$CON"
+  else
+    echo "NM=reapply_warn HINT='nmcli con up $CON' (addr already live)"
+  fi
+fi
+
+# Verify
+if ip -6 addr show dev "$IFACE" | grep -qE "inet6[[:space:]]+${ADDR}/"; then
+  echo "VERIFY=ok ADDR=$ADDR"
+  echo "STATUS=done LIVE_ADDED=$LIVE_ADDED NM_ADDED=$NM_ADDED CIDR=$CIDR"
+  # Show Tor SLAAC still present (informational)
+  if ip -6 addr show dev "$IFACE" | grep -q '2a02:168:53a8:0:d584:9e34:13cf:15d6'; then
+    echo "TOR_SLAAC=present"
+  else
+    echo "TOR_SLAAC=absent_or_changed HINT=ok_if_privacy_temp_rotated"
+  fi
+  exit 0
+fi
+
+echo "STATUS=verify_fail ADDR=$ADDR"
+ip -6 addr show dev "$IFACE" || true
+exit 1