diff --git a/modules/tailscale/exit-node.nix b/modules/tailscale/exit-node.nix
index 73d9f8a..a965fe5 100644
--- a/modules/tailscale/exit-node.nix
+++ b/modules/tailscale/exit-node.nix
@@ -1,8 +1,16 @@
 { vars, ... }:
 
 {
+  imports = [ ./enable-service.nix ];
+
   services.tailscale = {
-    enable = true;
+    # Enables the sysctl forwarding settings exit nodes/subnet routers need;
+    # without this, --advertise-exit-node has no effect.
+    useRoutingFeatures = "server";
+
+    # Lets peers reach this node directly over the tailscale UDP port
+    # instead of relaying through DERP.
+    openFirewall = true;
 
     extraUpFlags = [
       "--advertise-exit-node"