Some of our service providers require us to provide the IP addresses of our services to them for them to safelist. It’s stupid, but it’s not something we can control.
Rather than constantly update them as our servers change, we route through a NAT. I wouldn’t know how to do it with IPv6. Maybe the service provider could safelist a subnet?