diff --git a/hw/straylight/default.nix b/hw/straylight/default.nix
index 38d643a..1e60844 100644
--- a/hw/straylight/default.nix
+++ b/hw/straylight/default.nix
@@ -202,25 +202,24 @@ in
 
     # TLS for the llama.cpp API over the tailnet. Clients using
     # https://straylight.scylla-hammerhead.ts.net/v1 hit Tailscale Serve on
-    # :443, which proxies to llama-server on localhost:11434. A boot oneshot
-    # is not enough: `tailscale serve reset` clears the config without
-    # stopping this unit, so a timer re-applies it.
+    # :443, which proxies to llama-server on localhost:11434. Re-apply every
+    # 5s so `tailscale serve reset` cannot leave the API dark.
     systemd.services.tailscale-serve-llama = {
-      description = "Tailscale HTTPS proxy for llama-server";
+      description = "Keep Tailscale HTTPS proxy for llama-server";
       after = [ "tailscaled.service" "llama-server.service" ];
       wants = [ "tailscaled.service" ];
+      wantedBy = [ "multi-user.target" ];
       serviceConfig = {
-        Type = "oneshot";
-        ExecStart = "${pkgs.tailscale}/bin/tailscale serve --bg --https=443 http://127.0.0.1:11434";
-      };
-    };
-    systemd.timers.tailscale-serve-llama = {
-      description = "Re-apply Tailscale HTTPS proxy for llama-server";
-      wantedBy = [ "timers.target" ];
-      timerConfig = {
-        OnBootSec = "15s";
-        OnUnitActiveSec = "1min";
-        Unit = "tailscale-serve-llama.service";
+        Type = "simple";
+        Restart = "always";
+        RestartSec = "5s";
+        ExecStart = pkgs.writeShellScript "tailscale-serve-llama" ''
+          set -eu
+          while true; do
+            ${pkgs.tailscale}/bin/tailscale serve --bg --https=443 http://127.0.0.1:11434 >/dev/null || true
+            sleep 5
+          done
+        '';
       };
     };