diff --git a/modules/nixos/services.nix b/modules/nixos/services.nix
index cb716d2..b38b5f8 100644
--- a/modules/nixos/services.nix
+++ b/modules/nixos/services.nix
@@ -4,6 +4,10 @@
     tuned.enable = true;
     upower.enable = true;
     fwupd.enable = true;
-    tailscale.enable = true;
+    tailscale = {
+      enable = true;
+      # inbound 41641/udp so peers can connect directly instead of via DERP
+      openFirewall = true;
+    };
   };
 }