diff --git a/flake.lock b/flake.lock
index f594eff..6edf76b 100644
--- a/flake.lock
+++ b/flake.lock
@@ -393,6 +393,7 @@
         "nixpkgs-unstable": "nixpkgs-unstable",
         "sgard": "sgard",
         "sift": "sift",
+        "tether": "tether",
         "tracker": "tracker"
       }
     },
@@ -489,6 +490,27 @@
         "type": "github"
       }
     },
+    "tether": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1790149025,
+        "narHash": "sha256-3EUf6ke80hm8o+YyS3wsEfEl5P4a6z6XCNwgYRIhxos=",
+        "ref": "refs/heads/master",
+        "rev": "c89894b8dcac89aaea9ad72529524c1204884bc0",
+        "revCount": 3,
+        "type": "git",
+        "url": "ssh://git@git.wntrmute.dev/kyle/tether"
+      },
+      "original": {
+        "rev": "c89894b8dcac89aaea9ad72529524c1204884bc0",
+        "type": "git",
+        "url": "ssh://git@git.wntrmute.dev/kyle/tether"
+      }
+    },
     "tracker": {
       "inputs": {
         "nixpkgs": [
diff --git a/flake.nix b/flake.nix
index 2df4efe..efe3fdd 100644
--- a/flake.nix
+++ b/flake.nix
@@ -26,6 +26,9 @@
     sift.url = "git+ssh://git@git.wntrmute.dev/kyle/sift?rev=2db001e0d763d0dfd5816076eec5d69187396704";
     sift.inputs.nixpkgs.follows = "nixpkgs";
 
+    tether.url = "git+ssh://git@git.wntrmute.dev/kyle/tether?rev=c89894b8dcac89aaea9ad72529524c1204884bc0";
+    tether.inputs.nixpkgs.follows = "nixpkgs";
+
     lector.url = "github:kisom/lector";
     lector.inputs.nixpkgs.follows = "nixpkgs";
 
diff --git a/hw/dixie/default.nix b/hw/dixie/default.nix
index 1bc6367..090aef4 100644
--- a/hw/dixie/default.nix
+++ b/hw/dixie/default.nix
@@ -125,6 +125,7 @@ in
   imports = [
     ./hardware-configuration.nix
     ./disk-config.nix
+    inputs.tether.nixosModules.tether
   ];
 
   config = {
@@ -188,15 +189,21 @@ in
       port = 11433; preset = visionModelsIni; modelsMax = 1;
     };
 
+    services.tether = {
+      enable = true;
+      listen = "0.0.0.0:11435";
+      upstream = "http://127.0.0.1:11434";
+    };
+
     # Wi-Fi only host. NetworkManager comes from the base config; the AX9L (mt7921u) becomes
     # the primary once plugged in and the internal CNVi radio stays as fallback. Connection
     # profiles are copied from the live-USB session at install time (see the install notes),
     # not stored in this repo.
     networking.networkmanager.wifi.backend = "wpa_supplicant";
 
-    # Reachable only over the tailnet: 11434 (router) and 11433 (vision) on tailscale0, and
-    # SSH from the LAN (base config opens 22) for bring-up.
-    networking.firewall.interfaces.tailscale0.allowedTCPPorts = [ 11433 11434 ];
+    # Reachable only over the tailnet: 11434 (router), 11433 (vision), 11435 (tether)
+    # on tailscale0, and SSH from the LAN (base config opens 22) for bring-up.
+    networking.firewall.interfaces.tailscale0.allowedTCPPorts = [ 11433 11434 11435 ];
 
     environment.systemPackages = with pkgs; [
       llama-cpp