diff --git a/modules/system/tailscale.nix b/modules/system/tailscale.nix
index 9de220d..4bded31 100644
--- a/modules/system/tailscale.nix
+++ b/modules/system/tailscale.nix
@@ -4,5 +4,6 @@
     enable = true;
     authKeyFile = config.age.secrets.tailscale_auth.path;
     openFirewall = true;
+    useRoutingFeatures = if config.me.environment == "headless" then "both" else "client";
   };
 }