diff --git a/packages/secubox-nac/api/main.py b/packages/secubox-nac/api/main.py
index a464d7a6..1ef2dacb 100644
--- a/packages/secubox-nac/api/main.py
+++ b/packages/secubox-nac/api/main.py
@@ -247,13 +247,30 @@ def _parse_leases() -> list[dict]:
     return clients
 
 
-# Interfaces to scan for ARP entries (LAN interfaces only)
-LAN_INTERFACES = {"lan0", "lan1", "lan2", "lan3", "br0", "br-lan", "eth0", "eth1"}
+# Interfaces to scan for ARP entries. Defaults cover the DSA switch LAN ports,
+# common bridges, and the secubox LXC bridge (br-lxc — its containers are
+# managed clients). A board whose clients reach it on another interface (e.g.
+# gk2 sits transparently on the upstream 192.168.1.0/24 via eth2) extends this
+# via nac config `lan_interfaces` (list or comma string) — WITHOUT this, ARP
+# discovery filters every neighbour out and the dashboard shows no clients.
+_DEFAULT_LAN_INTERFACES = {"lan0", "lan1", "lan2", "lan3", "br0", "br-lan", "br-lxc", "eth0", "eth1"}
+
+
+def _lan_interfaces() -> set:
+    try:
+        cfg = get_config("nac") or {}
+        extra = cfg.get("lan_interfaces") or []
+        if isinstance(extra, str):
+            extra = [x.strip() for x in extra.split(",") if x.strip()]
+        return _DEFAULT_LAN_INTERFACES | set(extra)
+    except Exception:
+        return _DEFAULT_LAN_INTERFACES
 
 
 def _parse_arp() -> list[dict]:
     """Parse ARP table for network clients (fallback when DHCP leases unavailable)."""
     clients = []
+    lan_ifs = _lan_interfaces()
     try:
         # Use ip neigh for more reliable ARP parsing
         r = subprocess.run(
@@ -287,7 +304,7 @@ def _parse_arp() -> list[dict]:
                 continue
 
             # Only include clients from LAN interfaces
-            if iface and iface not in LAN_INTERFACES:
+            if iface and iface not in lan_ifs:
                 continue
 
             # Skip IPv6 link-local
diff --git a/packages/secubox-nac/debian/changelog b/packages/secubox-nac/debian/changelog
index 907a11c0..bb5b280c 100644
--- a/packages/secubox-nac/debian/changelog
+++ b/packages/secubox-nac/debian/changelog
@@ -1,3 +1,12 @@
+secubox-nac (1.0.5-1~bookworm1) bookworm; urgency=medium
+
+  * fix: NAC discovered 0 clients when devices live on br-lxc or an interface
+    outside the hardcoded LAN set (dashboard showed only the template). ARP
+    discovery now includes br-lxc by default and reads extra interfaces from
+    nac config  (gk2: eth2).
+
+ -- Gerald KERMA <devel@cybermind.fr>  Thu, 10 Jul 2026 11:00:00 +0200
+
 secubox-nac (1.0.4-1~bookworm2) bookworm; urgency=medium
 
   * webui: hybrid-dark cyan reskin (WebUI Panel Guidelines) baked into the package.