diff --git a/services/vpn/tailscale.nix b/services/vpn/tailscale.nix
index 86e93d7..8c874af 100644
--- a/services/vpn/tailscale.nix
+++ b/services/vpn/tailscale.nix
@@ -5,6 +5,19 @@
 # to declare `sops.secrets.tailscale_authkey` (see each host's secrets.nix).
 # Not for the VM (no sops).
 {
+  # TEMPORARY: nixpkgs bumped tailscale 1.98.8->1.98.9 without updating
+  # vendorHash (NixOS/nixpkgs#545860, fixed on the `release-26.05` branch
+  # 2026-07-26 but not yet promoted to the `nixos-26.05` channel branch this
+  # flake tracks). Remove this override once `nix flake lock --update-input
+  # nixpkgs` picks up a nixos-26.05 rev at/after that fix.
+  nixpkgs.overlays = [
+    (final: prev: {
+      tailscale = prev.tailscale.overrideAttrs (old: {
+        vendorHash = "sha256-Sd2iLJ7eDfDYdIRuW4xuiKgzhQWJWGAnz97FJWrVRlE=";
+      });
+    })
+  ];
+
   services.tailscale = {
     enable = true;
     openFirewall = true;                       # UDP 41641 for direct connections