diff --git a/nixos/configuration.nix b/nixos/configuration.nix
index f6e81cd1..5cf7af19 100644
--- a/nixos/configuration.nix
+++ b/nixos/configuration.nix
@@ -40,6 +40,7 @@
     ./sni.nix
     ./syncthing.nix
     ./taffybar.nix
+    ./tailscale.nix
     ./tts.nix
     ./user-specific.nix
     ./users.nix
diff --git a/nixos/tailscale.nix b/nixos/tailscale.nix
new file mode 100644
index 00000000..72e71af2
--- /dev/null
+++ b/nixos/tailscale.nix
@@ -0,0 +1,10 @@
+{ config, lib, pkgs, makeEnable, ... }:
+makeEnable config "myModules.tailscale" true {
+  # Provide stable SSH connectivity between your machines without needing port
+  # forwarding (works behind NAT/CGNAT).
+  services.tailscale.enable = true;
+
+  # Handy even if you only enable the service and run `tailscale up` manually.
+  environment.systemPackages = [ pkgs.tailscale ];
+}
+
diff --git a/nixos/wsl.nix b/nixos/wsl.nix
index db53d01c..b67e7434 100644
--- a/nixos/wsl.nix
+++ b/nixos/wsl.nix
@@ -8,6 +8,9 @@ makeEnable config "myModules.wsl" false {
   myModules.desktop.enable = false;
   myModules.xmonad.enable = false;
   myModules.plasma.enable = false;
+  # Tailscale-in-WSL is usually better handled by the Windows host Tailscale
+  # client. Disable by default so WSL machines don't fail to start tailscaled.
+  myModules.tailscale.enable = false;
 
   services.tzupdate.enable = true;