diff --git a/headscale/config.yaml b/headscale/config.yaml
index 31d0b76..7cbbbe9 100644
--- a/headscale/config.yaml
+++ b/headscale/config.yaml
@@ -57,14 +57,18 @@ dns:
       - 1.1.1.1
       - 1.0.0.1
   search_domains: []
-  # Served only to tailnet clients via MagicDNS: overrides falcon.pivoine.art
-  # app hostnames to resolve to the VPS's tailscale IP instead of its public
+  # Served only to tailnet clients via MagicDNS: overrides these hostnames to
+  # resolve to the VPS's own tailscale IP (100.64.0.3) instead of its public
   # one, so VPN-connected clients route straight over the tunnel and satisfy
-  # Traefik's falcon-vpn-only IP allowlist.
+  # Traefik's vpn-only IP allowlist. Anyone not on the tailnet still gets the
+  # normal public DNS record and hits the same allowlist from outside it.
   extra_records:
     - name: "triggershell.falcon.pivoine.art"
       type: "A"
       value: "100.64.0.3"
+    - name: "pulsenode.pivoine.art"
+      type: "A"
+      value: "100.64.0.3"
 
 # TLS is terminated by Traefik; headscale itself serves plain HTTP internally.
 tls_letsencrypt_hostname: ""