Giving Pi-hole a real IP on the network with MetalLB, creating a dedicated VLAN for ad-blocked WiFi, and pointing a Ruckus SSID at it.