diff --git a/modules/tailscale/exit-node.nix b/modules/tailscale/exit-node.nix
index f23fda8..1559ae2 100644
--- a/modules/tailscale/exit-node.nix
+++ b/modules/tailscale/exit-node.nix
@@ -1,8 +1,16 @@
 _:
 
 {
+  imports = [ ./enable-service.nix ];
+
   services.tailscale = {
-    enable = true;
+    # Enables the sysctl forwarding settings exit nodes/subnet routers need;
+    # without this, --advertise-exit-node has no effect.
+    useRoutingFeatures = "server";
+
+    # Lets peers reach this node directly over the tailscale UDP port
+    # instead of relaying through DERP.
+    openFirewall = true;
 
     # extraSetFlags (tailscale set, via the always-on tailscaled-set
     # service), not extraUpFlags -- extraUpFlags is only ever applied by