diff --git a/bgp/configure_bgp_tor.sh b/bgp/configure_bgp_tor.sh
index ae6be3cb0..e78bf8c9d 100755
--- a/bgp/configure_bgp_tor.sh
+++ b/bgp/configure_bgp_tor.sh
@@ -62,6 +62,8 @@ router bgp ${BGP_TOR_ASN}
  no bgp ebgp-requires-policy
  neighbor CLUSTER peer-group
  neighbor CLUSTER remote-as ${BGP_CLUSTER_ASN}
+ neighbor CLUSTER password ${BGP_VIP_PASSWORD:-dev-scripts-bgp}
+ neighbor CLUSTER bfd
 ${LISTEN_RANGES}${ADDRESS_FAMILIES}!
 EOF
 
@@ -80,7 +82,7 @@ eigrpd=no
 babeld=no
 sharpd=no
 pbrd=no
-bfdd=no
+bfdd=yes
 fabricd=no
 vrrpd=no
 pathd=no
@@ -88,10 +90,16 @@ pathd=no
 vtysh_enable=yes
 zebra_options="  -A 127.0.0.1 -s 90000000"
 bgpd_options="   -A 127.0.0.1"
+bfdd_options="   -A 127.0.0.1"
 EOF
 
 sudo firewall-cmd --zone=libvirt --permanent --add-port=179/tcp
 sudo firewall-cmd --zone=libvirt --add-port=179/tcp
+# BFD control and echo (single hop, RFC 5881)
+for port in 3784 3785; do
+    sudo firewall-cmd --zone=libvirt --permanent --add-port=${port}/udp
+    sudo firewall-cmd --zone=libvirt --add-port=${port}/udp
+done
 
 sudo podman run -d --replace --name "${BGP_TOR_NAME}" --net host --privileged \
     -v "${BGP_TOR_DIR}/frr.conf:/etc/frr/frr.conf:z" \
diff --git a/config_example.sh b/config_example.sh
index ef41c477a..a3a411992 100755
--- a/config_example.sh
+++ b/config_example.sh
@@ -253,11 +253,22 @@ set -x
 # BGPBasedVIPManagement gate (DevPreviewNoUpgrade). The local ASN defaults
 # to BGP_CLUSTER_ASN, the peer ASN to BGP_TOR_ASN, and the peer address to
 # the ToR address on the external subnet; override the peer address with
-# BGP_VIP_PEER_ADDRESS if your topology differs.
+# BGP_VIP_PEER_ADDRESS if your topology differs. On dual-stack deployments
+# a second peer is rendered for the ToR's IPv6 address on the external v6
+# subnet (override with BGP_VIP_PEER_ADDRESS_V6).
 # Default is unset.
 #
 #export BGP_VIP_MANAGEMENT=true
 #export BGP_VIP_PEER_ADDRESS=
+#export BGP_VIP_PEER_ADDRESS_V6=
+#
+# Every optional peer field (port, timers, password, BFD, eBGP multihop)
+# is set on purpose so the full rendering path is exercised end to end;
+# the ToR is configured to match. Timers are Go durations of whole
+# seconds; the session password must match on both ends.
+#export BGP_VIP_HOLD_TIME=90s
+#export BGP_VIP_KEEPALIVE_TIME=30s
+#export BGP_VIP_PASSWORD=dev-scripts-bgp
 #
 # FRR container image:
 #export BGP_TOR_IMAGE=quay.io/frrouting/frr:9.1.0
diff --git a/ocp_install_env.sh b/ocp_install_env.sh
index 09d96075a..fcce94919 100644
--- a/ocp_install_env.sh
+++ b/ocp_install_env.sh
@@ -200,15 +200,38 @@ EOF
 
 function bgp_vip_config() {
     if [[ "${BGP_VIP_MANAGEMENT:-false}" == "true" ]]; then
-        local peer_address
+        local peer_address peer_address_v6
         peer_address="${BGP_VIP_PEER_ADDRESS:-$(nth_ip "${EXTERNAL_SUBNET_V4}" 1)}"
+        # Set every optional peer field so e2e exercises the full
+        # rendering path (dead fields and format bugs are invisible on
+        # the defaults-only happy path). The ToR side is configured to
+        # match by bgp/configure_bgp_tor.sh; the verify CI step asserts
+        # the negotiated timers and BFD state at the ToR.
+        local peer_options
+        peer_options="        port: 179
+        holdTime: \"${BGP_VIP_HOLD_TIME:-90s}\"
+        keepaliveTime: \"${BGP_VIP_KEEPALIVE_TIME:-30s}\"
+        password: \"${BGP_VIP_PASSWORD:-dev-scripts-bgp}\"
+        bfdEnabled: \"true\"
+        ebgpMultiHop: \"true\""
 cat <<EOF
     bgpVIPConfig:
       localASN: ${BGP_CLUSTER_ASN:-64512}
       peers:
       - peerAddress: ${peer_address}
         peerASN: ${BGP_TOR_ASN:-64513}
+${peer_options}
 EOF
+        # dual-stack: peer with the ToR over IPv6 as well, so the
+        # secondary-family VIPs have a same-family BGP session
+        if [[ -n "${EXTERNAL_SUBNET_V6:-}" ]]; then
+            peer_address_v6="${BGP_VIP_PEER_ADDRESS_V6:-$(nth_ip "${EXTERNAL_SUBNET_V6}" 1)}"
+cat <<EOF
+      - peerAddress: ${peer_address_v6}
+        peerASN: ${BGP_TOR_ASN:-64513}
+${peer_options}
+EOF
+        fi
     fi
 }