diff --git a/spinifex/services/vpcd/topology.go b/spinifex/services/vpcd/topology.go
index b83370bd4..1e96c4325 100644
--- a/spinifex/services/vpcd/topology.go
+++ b/spinifex/services/vpcd/topology.go
@@ -526,6 +526,12 @@ func (h *TopologyHandler) handleVPCCreate(msg *nats.Msg) {
 		ExternalIDs: map[string]string{
 			"spinifex:vpc_id": evt.VpcId,
 			"spinifex:vni":    strconv.FormatInt(evt.VNI, 10),
+			// Cleanup paths (handleIGWDetach, NAT sweeps) read this to scope
+			// their SNAT removal to the VPC's own CIDR. When unset, those
+			// paths fall back to an overbroad 10.0.0.0/8 and emit noisy
+			// "VPC CIDR missing from router metadata" WARNs. reconcileVPC
+			// stores the same key on startup; keep parity here.
+			"spinifex:cidr": evt.CidrBlock,
 		},
 	}
 
@@ -535,7 +541,7 @@ func (h *TopologyHandler) handleVPCCreate(msg *nats.Msg) {
 		return
 	}
 
-	slog.Info("vpcd: created logical router for VPC", "router", routerName, "vpc_id", evt.VpcId)
+	slog.Info("vpcd: created logical router for VPC", "router", routerName, "vpc_id", evt.VpcId, "cidr", evt.CidrBlock)
 	respond(msg, nil)
 }
 
diff --git a/spinifex/services/vpcd/topology_test.go b/spinifex/services/vpcd/topology_test.go
index 81c26c749..a5e6ef997 100644
--- a/spinifex/services/vpcd/topology_test.go
+++ b/spinifex/services/vpcd/topology_test.go
@@ -73,6 +73,9 @@ func TestTopologyHandler_VPCCreate(t *testing.T) {
 	if lr.ExternalIDs["spinifex:vni"] != "100" {
 		t.Errorf("expected vni external_id=100, got %v", lr.ExternalIDs["spinifex:vni"])
 	}
+	if lr.ExternalIDs["spinifex:cidr"] != "10.0.0.0/16" {
+		t.Errorf("expected cidr external_id=10.0.0.0/16, got %v", lr.ExternalIDs["spinifex:cidr"])
+	}
 }
 
 func TestTopologyHandler_VPCDelete(t *testing.T) {