diff --git a/pulsenode/config/config.yml b/pulsenode/config/config.yml
index 0a64a80..faeb163 100644
--- a/pulsenode/config/config.yml
+++ b/pulsenode/config/config.yml
@@ -12,7 +12,7 @@ groups:
 
       - type: traefik
         name: Traefik
-        apiUrl: http://traefik:8080/api
+        apiUrl: https://traefik.pivoine.art/api
         interval: 15s
 
       - type: docker
diff --git a/traefik/compose.yml b/traefik/compose.yml
index 565bf6a..4ad76ca 100644
--- a/traefik/compose.yml
+++ b/traefik/compose.yml
@@ -3,6 +3,7 @@ services:
     image: traefik:v3
     container_name: traefik
     command:
+      - "--api=true"
       - "--api.dashboard=true"
       - "--ping=true"
       - "--log.level=INFO"
@@ -16,9 +17,6 @@ services:
       - "--providers.file.watch=true"
       - "--entrypoints.web.address=:80"
       - "--entrypoints.web-secure.address=:443"
-      # Internal-only: not in ports: below, so only reachable from other
-      # containers on falcon_network (i.e. pulsenode's traefik widget).
-      - "--entrypoints.traefik.address=:8080"
       - "--entrypoints.web.http.redirections.entryPoint.to=web-secure"
       - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
       - "--entrypoints.web.http.redirections.entryPoint.permanent=true"
diff --git a/traefik/dynamic/dashboard.yaml b/traefik/dynamic/dashboard.yaml
new file mode 100644
index 0000000..383711f
--- /dev/null
+++ b/traefik/dynamic/dashboard.yaml
@@ -0,0 +1,32 @@
+# Exposes Traefik's own API/dashboard (api@internal is a built-in service,
+# not something defined below) on traefik.pivoine.art, gated by vpn-only.
+# Path prefixes match Traefik's own documented self-referencing pattern:
+# /api serves the JSON pulsenode's traefik widget reads, /dashboard serves
+# the browsable UI.
+http:
+  middlewares:
+    traefik-redirect-web-secure:
+      redirectScheme:
+        scheme: https
+
+  routers:
+    traefik-dashboard-web:
+      rule: "Host(`traefik.pivoine.art`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
+      entrypoints:
+        - web
+      middlewares:
+        - vpn-only@file
+        - traefik-redirect-web-secure
+      service: api@internal
+
+    traefik-dashboard-web-secure:
+      rule: "Host(`traefik.pivoine.art`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
+      entrypoints:
+        - web-secure
+      tls:
+        certResolver: resolver
+      middlewares:
+        - vpn-only@file
+        - security-headers@file
+        - no-index@file
+      service: api@internal
diff --git a/traefik/dynamic/security.yaml b/traefik/dynamic/security.yaml
index 8b95bf5..dbf65bf 100644
--- a/traefik/dynamic/security.yaml
+++ b/traefik/dynamic/security.yaml
@@ -45,11 +45,15 @@ http:
         burst: 15
         period: 1s
     # Only let traffic through whose source IP is inside the Tailscale/Headscale
-    # mesh (100.64.0.0/10, fd7a:115c:a1e0::/48). Public DNS can still resolve
-    # these hostnames, but anyone reaching them over the open internet gets a
-    # 403 — this range is only reachable by actually being a peer on the tailnet.
+    # mesh (100.64.0.0/10, fd7a:115c:a1e0::/48) or on falcon_network itself
+    # (172.18.0.0/16) - the latter so containers on our own internal docker
+    # network (e.g. pulsenode calling this router directly to reach
+    # api@internal) count as trusted the same way a tailnet peer does. Public
+    # DNS can still resolve these hostnames, but anyone reaching them over the
+    # open internet gets a 403.
     vpn-only:
       ipAllowList:
         sourceRange:
           - "100.64.0.0/10"
           - "fd7a:115c:a1e0::/48"
+          - "172.18.0.0/16"