diff --git a/pong.proto b/pong.proto
index 715a75a..3b2091e 100644
--- a/pong.proto
+++ b/pong.proto
@@ -29,9 +29,11 @@ message Property {
   // ISO 3166-1 alpha-2 country code of the slot ("US", "DE", …).
   string country = 2;
 
-  // Public IPv4 of the Node currently backing this slot, in dotted
-  // form ("203.0.113.7"). Empty / "0.0.0.0" while the slot is
-  // detached.
+  // Deprecated: use ip_bytes. Public IPv4 of the Node currently
+  // backing this slot, in dotted form ("203.0.113.7"). Empty /
+  // "0.0.0.0" while the slot is detached. New consumers should
+  // read ip_bytes instead; this field will be reserved once all
+  // clients have migrated.
   string ip = 4;
 
   // TCP port to dial on the backing Node. Always 443 in production
@@ -50,6 +52,12 @@ message Property {
   // Node, in which case the Hub re-attaches it to a fresh Node and
   // the client receives an updated Property.
   uint64 expires = 7;
+
+  // Public IPv4 of the Node currently backing this slot, as four
+  // raw bytes in network byte order — same encoding as Peer.ip.
+  // Empty (zero-length) while the slot is detached. Replaces the
+  // deprecated string ip field (field 4).
+  bytes ip_bytes = 8;
 }
 
 // Peer describes one sibling Node in the fleet, advertised to