diff --git a/services/dev/gitea.nix b/services/dev/gitea.nix
index ff21b02..7cdb25e 100644
--- a/services/dev/gitea.nix
+++ b/services/dev/gitea.nix
@@ -77,6 +77,23 @@ in
       service = {
         DISABLE_REGISTRATION = true;
       };
+      security = {
+        # Gitea refuses to deliver a webhook to any host outside this list,
+        # which defaults to `external` — "a valid non-private unicast IP".
+        # Tailscale addresses are 100.64.0.0/10 (RFC 6598 carrier-grade NAT),
+        # which is neither RFC1918 private nor, as far as gitea's matcher is
+        # concerned, external — so the hermes relay on mars was refused with
+        #   deny 'mars.orbit.sol(100.64.0.6:8645)'
+        # even though nothing here is private in the RFC1918 sense. Adding
+        # the tailnet CIDR is what makes tailnet-internal webhook targets
+        # deliverable at all; `external` is kept so a future webhook to a
+        # public service (discord, slack) still works without another edit.
+        #
+        # This lives in [security], not [webhook]: the webhook-section key is
+        # deprecated and now just falls back to this one, which is the name
+        # the delivery error itself reports.
+        ALLOWED_HOST_LIST = "external,100.64.0.0/10";
+      };
       actions = {
         ENABLED = true;
       };