diff --git a/src/printer/bambu.rs b/src/printer/bambu.rs
index 69c8eeb..3d405a8 100644
--- a/src/printer/bambu.rs
+++ b/src/printer/bambu.rs
@@ -56,6 +56,16 @@ impl BambuTls {
     fn build_connector(&self) -> anyhow::Result<native_tls::TlsConnector> {
         let mut builder = native_tls::TlsConnector::builder();
 
+        // Bambu printer certificates don't carry their LAN IP as a Subject
+        // Alternative Name — it's DHCP-assigned, so baking it in at
+        // manufacture time wouldn't make sense. Hostname verification has
+        // to be off regardless of trust mode: what matters is whether the
+        // certificate chains to a CA we trust, not whether its SAN matches
+        // the specific IP we happened to dial today. Chain verification
+        // itself stays fully enforced below for BundledCa/Custom — this
+        // narrows *what* gets checked, it doesn't turn checking off.
+        builder.danger_accept_invalid_hostnames(true);
+
         if matches!(self, BambuTls::Insecure) {
             builder.danger_accept_invalid_certs(true);
         } else {