diff --git a/group_vars/dhcp/vars.yml b/group_vars/dhcp/vars.yml
new file mode 100644
index 0000000..77933c1
--- /dev/null
+++ b/group_vars/dhcp/vars.yml
@@ -0,0 +1,4 @@
+---
+dhcp_failover:
+  primary_host: dhcp-{{ apartment_block }}.adm.auro.re
+  secondary_host: dhcp-{{ apartment_block }}-backup.adm.auro.re
diff --git a/group_vars/pacaterie/dhcp.yml b/group_vars/pacaterie/dhcp.yml
index 3fdf3c8..043d26d 100644
--- a/group_vars/pacaterie/dhcp.yml
+++ b/group_vars/pacaterie/dhcp.yml
@@ -5,7 +5,3 @@ subnet_ids:
   ap: 142
   users_wired: 20
   users_wifi: 21
-
-failover:
-  own_address: 10.128.2.254
-  peer_address: 10.128.2.154
diff --git a/hosts b/hosts
index d8defaf..83a6c53 100644
--- a/hosts
+++ b/hosts
@@ -150,9 +150,9 @@ gs_pve
 
 [dhcp]
 dhcp-fleming.adm.auro.re
-#dhcp-fleming-backup.adm.auro.re
+dhcp-fleming-backup.adm.auro.re
 dhcp-pacaterie.adm.auro.re
-#dhcp-pacaterie-backup.adm.auro.re
+dhcp-pacaterie-backup.adm.auro.re
 #dhcp-edc.adm.auro.re
 #dhcp-gs.adm.auro.re
 
diff --git a/roles/isc-dhcp-server/templates/dhcp/dhcpd.conf.j2 b/roles/isc-dhcp-server/templates/dhcp/dhcpd.conf.j2
index 5ab2be5..da9f4d1 100644
--- a/roles/isc-dhcp-server/templates/dhcp/dhcpd.conf.j2
+++ b/roles/isc-dhcp-server/templates/dhcp/dhcpd.conf.j2
@@ -1,5 +1,5 @@
 # dhcpd.conf
-{{ ansible_managed }}
+# {{ ansible_managed }}
 
 default-lease-time 86400;
 max-lease-time 86400;
@@ -24,6 +24,7 @@ authoritative;
 
 # Use this to send dhcp log messages to a different log file (you also
 # have to hack syslog.conf to complete the redirection).
+# XXX: This was enabled in one building and disabled in another.
 #log-facility local7;
 
 
@@ -65,21 +66,42 @@ subnet 10.{{ subnet_ids.users_wifi }}.0.0 netmask 255.255.0.0 {
        include "/var/local/re2o-services/dhcp/generated/dhcp.wifi.{{ apartment_block }}.auro.re.list";
 
        pool {
-            range 10.{{ subnet_ids.users_wifi }}.8.0 10.{{ subnet_ids.users_wired }}.10.255;
+            range 10.{{ subnet_ids.users_wifi }}.8.0 10.{{ subnet_ids.users_wifi }}.10.255;
 
-{% if failover is defined %}
-            failover peer "dhcp-failover" {
+{% if dhcp_failover is defined %}
+            failover peer "dhcp-failover";
+{% endif %}
+       }
+}
+
+{% if dhcp_failover is defined %}
+failover peer "dhcp-failover" {
+{% if inventory_hostname == dhcp_failover.primary_host %}
                 primary;
-                split 128;
+
+                # MCLT = Maximum Client Lead Time.
+                # Must be specified on the primary, forbidden on the secondary.
                 mclt 3600;
-                address {{ failover.own_address }};
+
+                # Address or DNS name on which this node listens for connections
+                # from its failover peer.
+                address {{ dhcp_failover.primary_host }};
+                peer address {{ dhcp_failover.secondary_host }};
+{% endif %}
+{% if inventory_hostname == dhcp_failover.secondary_host %}
+                secondary;
+                # Address and peer address are reversed on the secondary node.
+                address {{ dhcp_failover.secondary_host }};
+                peer address {{ dhcp_failover.primary_host }};
+{% endif %}
+
+                # The following options can be shared between primary and
+                # secondary failover peers.
                 port 647;
-                peer address {{ failover.peer_address }};
                 peer port 647;
+                split 128;
                 max-response-delay 30;
                 max-unacked-updates 10;
                 load balance max seconds 3;
           }
 {% endif %}
-       }
-}