diff --git a/NetbirdNetworkExtension/PacketTunnelProviderSettingsManager.swift b/NetbirdNetworkExtension/PacketTunnelProviderSettingsManager.swift
index 99d4411..89a6a3e 100644
--- a/NetbirdNetworkExtension/PacketTunnelProviderSettingsManager.swift
+++ b/NetbirdNetworkExtension/PacketTunnelProviderSettingsManager.swift
@@ -129,6 +129,15 @@ class PacketTunnelProviderSettingsManager {
                         ipv6Settings.includedRoutes = v6Routes
                     }
                     tunnelNetworkSettings.ipv6Settings = ipv6Settings
+                } else {
+                    // Always assign IPv6 settings explicitly: leaving the property nil
+                    // makes setTunnelNetworkSettings KEEP the previously applied IPv6
+                    // config, so the ::/0 blackhole installed while an exit node was
+                    // selected would linger after deselect and keep black-holing traffic.
+                    let ipv6Settings = NEIPv6Settings(addresses: [Self.ipv6BlackholeAddress], networkPrefixLengths: [Self.ipv6BlackholePrefix])
+                    // Explicitly clear any previously-applied IPv6 routes.
+                    ipv6Settings.includedRoutes = []
+                    tunnelNetworkSettings.ipv6Settings = ipv6Settings
                 }
                 
                 tunnelNetworkSettings.mtu = 1280