diff --git a/Caddyfile b/Caddyfile
index 7f330d7..2d8c0ff 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -119,9 +119,12 @@ stash.ginnoir.com {
 }
 
 # =============================================================
-# GAMES / ROMS — public (temporarily; RomM has its own auth)
+# GAMES / ROMS — internal only
+# External access for a trusted friend is via the `share` stack's Tailscale
+# serve node (roms-share.<tailnet>.ts.net), NOT public exposure here.
 # =============================================================
 roms.ginnoir.com {
+	import internal_only
 	reverse_proxy romm:8080
 }