diff --git a/internal/tools/tools_test.go b/internal/tools/tools_test.go
index 81126ab..d93226d 100644
--- a/internal/tools/tools_test.go
+++ b/internal/tools/tools_test.go
@@ -20,17 +20,17 @@ func TestIsInternalIP(t *testing.T) {
 		"100.64.0.1",      // CGNAT start
 		"100.127.255.255", // CGNAT end
 		// IPv6 transition forms embedding an internal IPv4 destination — golang/go#79925.
-		"64:ff9b::a9fe:a9fe",     // NAT64 well-known (RFC 6052) wrapping 169.254.169.254
-		"64:ff9b:1::a9fe:a9fe",   // NAT64 local-use (RFC 8215) wrapping 169.254.169.254
-		"2002:a9fe:a9fe::",       // 6to4 (RFC 3056) wrapping 169.254.169.254
-		"::a9fe:a9fe",            // IPv4-compatible IPv6 (RFC 4291) wrapping 169.254.169.254
-		"64:ff9b::7f00:1",        // NAT64 wrapping 127.0.0.1
-		"2002:0a00:0001::",       // 6to4 wrapping 10.0.0.1
-		"::ffff:169.254.169.254", // IPv4-mapped (also caught by stdlib via To4)
-		"::5efe:a9fe:a9fe",       // ISATAP (RFC 5214) wrapping 169.254.169.254
-		"2001:db8::5efe:7f00:1",  // ISATAP under a documentation prefix wrapping 127.0.0.1
-		"fec0::1",                // deprecated site-local (RFC 3879 / RFC 4291 §2.5.7)
-		"2001:db8::1",            // documentation prefix (RFC 3849)
+		"64:ff9b::a9fe:a9fe",       // NAT64 well-known (RFC 6052) wrapping 169.254.169.254
+		"64:ff9b:1::a9fe:a9fe",     // NAT64 local-use (RFC 8215) wrapping 169.254.169.254
+		"2002:a9fe:a9fe::",         // 6to4 (RFC 3056) wrapping 169.254.169.254
+		"::a9fe:a9fe",              // IPv4-compatible IPv6 (RFC 4291) wrapping 169.254.169.254
+		"64:ff9b::7f00:1",          // NAT64 wrapping 127.0.0.1
+		"2002:0a00:0001::",         // 6to4 wrapping 10.0.0.1
+		"::ffff:169.254.169.254",   // IPv4-mapped (also caught by stdlib via To4)
+		"::5efe:a9fe:a9fe",         // ISATAP (RFC 5214) wrapping 169.254.169.254
+		"2001:db8::5efe:7f00:1",    // ISATAP under a documentation prefix wrapping 127.0.0.1
+		"fec0::1",                  // deprecated site-local (RFC 3879 / RFC 4291 §2.5.7)
+		"2001:db8::1",              // documentation prefix (RFC 3849)
 		"2001:db8::5efe:0808:0808", // documentation prefix (blocked regardless of embedded IPv4)
 	}
 	external := []string{