diff --git a/modules/system/wireguard.nix b/modules/system/wireguard.nix
index ca47ddb..186367f 100644
--- a/modules/system/wireguard.nix
+++ b/modules/system/wireguard.nix
@@ -25,30 +25,45 @@ let
     hyacinth = {
       publicKey = "6nVhazYdmC15A/nke9VrqIg3sOBVOmqj4GEsyBq7MVo=";
       allowedIPs = [ "10.100.0.3/32" "${gcSecrets.wireguard.ipv6Subnet}:3" "fd0d::3" ];
+      interfaces = {
+        wg0 = { peers = [ server6OnlyPeer ]; };
+        wg1 = { peers = [ serverPeer ]; autostart = false; };
+      };
     };
     anemone = {
       publicKey = "px5+JNdAmqBvUC++DhiJrUBRAr+BYP6iYVt4sbhPTWY=";
       allowedIPs = [ "10.100.0.4/32" "${gcSecrets.wireguard.ipv6Subnet}:4" "fd0d::4" ];
+      interfaces = {
+        wg0 = { peers = [ server6OnlyPeer ]; };
+        wg1 = { peers = [ serverPeer ]; autostart = false; };
+      };
     };
     hibiscus = {
       publicKey = "vQ5a2KMrwi7RCRsD0yvog+n35vQYFuvwiPn+W4lbRBw=";
       allowedIPs = [ "10.100.0.5/32" "${gcSecrets.wireguard.ipv6Subnet}:5" "fd0d::5" ];
+      interfaces = {
+        wg0 = { peers = [ server6OnlyPeer ]; };
+        wg1 = { peers = [ serverPeer ]; autostart = false; };
+      };
+    };
+    hazel = {
+      publicKey = "vQ5a2KMrwi7RCRsD0yvog+n35vQYFuvwiPn+W4lbRBw=";
+      allowedIPs = [ "10.100.0.21/32" "${gcSecrets.wireguard.ipv6Subnet}:21" "fd0d::21" ];
+      interfaces = {
+        wg0 = { peers = [ (serverPeerWith [ "10.100.0.0/24" "fd0d::/16" ]) ]; };
+      };
     };
   };
 
   clientPeers = builtins.attrValues clients;
-  serverPeer = {
+  serverPeerWith = ips: {
     publicKey = "3ugIk2tQZXjAH9/95s63ld2WNUHQrd4Mz5jzbln6oj0=";
-    allowedIPs = [ "0.0.0.0/0" "::/0" ];
-    endpoint = "${serverIp}:${toString port}";
-    persistentKeepalive = 25;
-  };
-  server6OnlyPeer = {
-    publicKey = "3ugIk2tQZXjAH9/95s63ld2WNUHQrd4Mz5jzbln6oj0=";
-    allowedIPs = [ "::/0" ];
+    allowedIPs = ips;
     endpoint = "${serverIp}:${toString port}";
     persistentKeepalive = 25;
   };
+  serverPeer = serverPeerWith [ "0.0.0.0/0" "::/0" ];
+  server6OnlyPeer = serverPeerWith [ "10.100.0.0/24" "::/0" ];
 
   serverConfig = {
     nat = {
@@ -83,23 +98,12 @@ let
     wg-quick.interfaces =
     let
       client = clients."${config.networking.hostName}";
-    in {
-      wg0 = {
+    in
+      builtins.mapAttrs (interface: conf: {
         address = client.allowedIPs;
         dns = [ "fd0d::1" "10.100.0.1" ];
         privateKeyFile = config.age.secrets."wg_${config.networking.hostName}".path;
-
-        peers = [ server6OnlyPeer ];
-      };
-      wg1 = {
-        address = client.allowedIPs;
-        dns = [ "fd0d::1" "10.100.0.1" ];
-        privateKeyFile = config.age.secrets."wg_${config.networking.hostName}".path;
-
-        peers = [ serverPeer ];
-        autostart = false;
-      };
-    };
+      } // conf) client.interfaces;
   };
 in {
   boot.kernel.sysctl = lib.mkIf (config.networking.hostName == serverName) ({
@@ -109,6 +113,6 @@ in {
   networking =
     lib.mkMerge [
       (lib.mkIf (config.networking.hostName == serverName) serverConfig)
-      (lib.mkIf (builtins.hasAttr config.networking.hostName clients) clientConfig)
+      (lib.mkIf (config.networking.hostName != serverName) clientConfig)
     ];
 }