diff --git a/internal/config/blocked_networks_internal_test.go b/internal/config/blocked_networks_internal_test.go
index 25373be..9267016 100644
--- a/internal/config/blocked_networks_internal_test.go
+++ b/internal/config/blocked_networks_internal_test.go
@@ -88,3 +88,45 @@ func TestBlockedNetworksInvalidAbortsStartup(t *testing.T) {
 		},
 	})
 }
+
+// TestBlockedNetworksMappedEntryIsIPv4Range checks that an entry written in
+// the IPv4-mapped form (::ffff:a.b.c.d) is kept as the IPv4 range it covers,
+// since the fetcher matches an IPv4-mapped address as the IPv4 address it
+// holds.
+func TestBlockedNetworksMappedEntryIsIPv4Range(t *testing.T) {
+	t.Parallel()
+
+	yamlContent := signingKeyLine + `blocked_networks:
+  - "::ffff:10.0.0.0/104"
+`
+
+	c, err := configFromYAML(t, yamlContent)
+	if err != nil {
+		t.Fatalf("an IPv4-mapped blocked_networks entry should load, got error: %v", err)
+	}
+
+	if len(c.BlockedNetworks) != 1 {
+		t.Fatalf("BlockedNetworks = %v, want 1 entry", c.BlockedNetworks)
+	}
+
+	if got := c.BlockedNetworks[0].String(); got != "10.0.0.0/8" {
+		t.Errorf("BlockedNetworks[0] = %q, want %q", got, "10.0.0.0/8")
+	}
+}
+
+// TestBlockedNetworksMappedEntryShorterThan96AbortsStartup checks that an
+// entry in the IPv4-mapped form shorter than /96, which covers more than the
+// IPv4 addresses, aborts startup with an error naming the key and the value.
+func TestBlockedNetworksMappedEntryShorterThan96AbortsStartup(t *testing.T) {
+	t.Parallel()
+
+	runAbortCases(t, []abortCase{
+		{
+			name: "mapped-shorter-than-96",
+			yaml: signingKeyLine + `blocked_networks:
+  - "::ffff:0.0.0.0/80"
+`,
+			wantErrSubstrings: []string{keyBlockedNetworks, "::ffff:0.0.0.0/80"},
+		},
+	})
+}