diff --git a/services/immich.nix b/services/immich.nix
index 507e48e..89e4721 100644
--- a/services/immich.nix
+++ b/services/immich.nix
@@ -51,6 +51,20 @@ in {
         forceSSL = true;
         useACMEHost = fqdn;
 
+        listen = [
+          # FIXME: hardcoded tailscale IP
+          {
+            addr = "100.115.172.44";
+            port = 443;
+            ssl = true;
+          }
+          {
+            addr = "100.115.172.44";
+            port = 80;
+            ssl = false;
+          }
+        ];
+
         locations."/" = {
           proxyPass = "http://127.0.0.1:${toString cfg.port}";
           proxyWebsockets = true;