diff --git a/server/src/__tests__/invite-test-resolution-route.test.ts b/server/src/__tests__/invite-test-resolution-route.test.ts
index 7cfcb590227..1376a6e24f4 100644
--- a/server/src/__tests__/invite-test-resolution-route.test.ts
+++ b/server/src/__tests__/invite-test-resolution-route.test.ts
@@ -92,6 +92,8 @@ describe("GET /invites/:token/test-resolution", () => {
     ["RFC1918 192.168/16", "http://192.168.1.10/api/health", "192.168.1.10"],
     ["link-local metadata", "http://169.254.169.254/latest/meta-data", "169.254.169.254"],
     ["multicast", "http://224.0.0.1/probe", "224.0.0.1"],
+    ["NAT64 well-known prefix", "https://gateway.example.test/health", "64:ff9b::0a00:0001"],
+    ["NAT64 local-use prefix", "https://gateway.example.test/health", "64:ff9b:1::0a00:0001"],
   ])("rejects %s targets before probing", async (_label, url, address) => {
     lookup.mockResolvedValue([{ address, family: address.includes(":") ? 6 : 4 }]);
     const app = createApp(createDbStub([createInvite()]));
diff --git a/server/src/routes/access.ts b/server/src/routes/access.ts
index fc9c6a0948e..bf9fbd48629 100644
--- a/server/src/routes/access.ts
+++ b/server/src/routes/access.ts
@@ -2178,6 +2178,7 @@ function isPrivateOrReservedIpv6(address: string) {
   if (lower.startsWith("2001:db8:") || lower === "2001:db8::") return true;
   if (lower.startsWith("2001:2:") || lower === "2001:2::") return true;
   if (lower.startsWith("2002:")) return true;
+  if (lower.startsWith("64:ff9b:")) return true;
   return false;
 }