diff --git a/Caddyfile b/Caddyfile
index 2bbe2e1..c073064 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -8,10 +8,12 @@
 # =============================================================
 # SNIPPETS
 # =============================================================
-# Reusable matcher — blocks anything not on the LAN.
+# Reusable matcher — blocks anything not on the LAN or tailnet.
 # Usage: import internal_only inside any site block.
+# 100.64.0.0/10 is the Tailscale CGNAT range — allows tailnet clients that
+# reach Caddy without subnet-route SNAT (i.e. --snat-subnet-routes=false).
 (internal_only) {
-	@blocked not remote_ip 192.168.1.0/24 172.16.0.0/12 127.0.0.1
+	@blocked not remote_ip 192.168.1.0/24 172.16.0.0/12 100.64.0.0/10 127.0.0.1
 	respond @blocked "Access denied" 403
 }