diff --git a/scripts/container-entrypoint.sh b/scripts/container-entrypoint.sh
index 2792bd5..7ae2c5a 100755
--- a/scripts/container-entrypoint.sh
+++ b/scripts/container-entrypoint.sh
@@ -170,10 +170,10 @@ check_ip_address_settings() {
 	check_env_var_or_set_default "IPV6_PREFIX" "${headscale_ipv6_prefix_default}"
 
 	if [[ "${IPV6_ONLY}" == "true" ]]; then
-		export IP_PREFIXES="v6: $IPV6_PREFIX"
+		export IP_PREFIXES="v6: ${IPV6_PREFIX}"
 	else
-		export IP_PREFIXES="v4: $IPV4_PREFIX
-  v6: $IPV6_PREFIX"
+		export IP_PREFIXES="v4: ${IPV4_PREFIX}
+  v6: ${IPV6_PREFIX}"
 	fi
 }
 
@@ -208,7 +208,7 @@ create_headscale_config() {
         "HEADSCALE_DNS_BASE_DOMAIN"
         "HEADSCALE_OVERRIDE_LOCAL_DNS"
         "MAGIC_DNS"
-		"IP_PREFIXES"
+        "IP_PREFIXES"
         "IP_ALLOCATION"
         "HEADSCALE_EXTRA_RECORDS_PATH"
     )
diff --git a/templates/secrets.template.env b/templates/secrets.template.env
index 11abe16..02106a6 100644
--- a/templates/secrets.template.env
+++ b/templates/secrets.template.env
@@ -24,6 +24,9 @@ HEADSCALE_DNS_BASE_DOMAIN=CHANGEME
 # IPV6_PREFIX="fd7a:115c:a1e0::/48"
 # IPV4_PREFIX="100.64.0.0/10"
 
+# Enable IPv6-only mode (disables IPv4 prefix allocation)
+# IPV6_ONLY=false
+
 # The following one can be set after first deployment
 # If not, it will require all Tailscale clients to restart on every deploy
 # HEADSCALE_NOISE_PRIVATE_KEY=CHANGEME