diff --git a/hosts/12kingdoms-youko/vpn.nix b/hosts/12kingdoms-youko/vpn.nix
index 747f5519..407a23a2 100644
--- a/hosts/12kingdoms-youko/vpn.nix
+++ b/hosts/12kingdoms-youko/vpn.nix
@@ -1,5 +1,4 @@
 {
-  pkgs,
   myvars,
   ...
 }:
@@ -7,13 +6,14 @@ let
   inherit (myvars.networking) hostsAddr k8sVip;
 in
 {
-  environment.systemPackages = [ pkgs.tailscale ];
+  # `services.tailscale` already puts the CLI in `environment.systemPackages`.
 
   services.tailscale = {
     enable = true;
     port = 41641;
     interfaceName = "tailscale0";
-    # allow the Tailscale UDP port through the firewall
+    # No-op here: the shared firewall opens 41641 in `extraInputRules` and
+    # forces `allowedUDPPorts` empty.
     openFirewall = true;
 
     useRoutingFeatures = "server";
diff --git a/modules/nixos/desktop/networking/tailscale.nix b/modules/nixos/desktop/networking/tailscale.nix
index 19b2dfc9..80d178db 100644
--- a/modules/nixos/desktop/networking/tailscale.nix
+++ b/modules/nixos/desktop/networking/tailscale.nix
@@ -1,6 +1,4 @@
 {
-  lib,
-  pkgs,
   ...
 }:
 # =============================================================
@@ -28,15 +26,15 @@
 #
 # =============================================================
 {
-  # make the tailscale command usable to users
-  environment.systemPackages = [ pkgs.tailscale ];
+  # `services.tailscale` already puts the CLI in `environment.systemPackages`.
 
   # enable the tailscale service
   services.tailscale = {
     enable = true;
     port = 41641;
     interfaceName = "tailscale0";
-    # allow the Tailscale UDP port through the firewall
+    # No-op here: the shared firewall opens 41641 in `extraInputRules` and
+    # forces `allowedUDPPorts` empty.
     openFirewall = true;
 
     useRoutingFeatures = "client";