diff --git a/traefik/dynamic/security.yaml b/traefik/dynamic/security.yaml
index dbf65bf..e973067 100644
--- a/traefik/dynamic/security.yaml
+++ b/traefik/dynamic/security.yaml
@@ -45,15 +45,22 @@ http:
         burst: 15
         period: 1s
     # Only let traffic through whose source IP is inside the Tailscale/Headscale
-    # mesh (100.64.0.0/10, fd7a:115c:a1e0::/48) or on falcon_network itself
-    # (172.18.0.0/16) - the latter so containers on our own internal docker
-    # network (e.g. pulsenode calling this router directly to reach
-    # api@internal) count as trusted the same way a tailnet peer does. Public
-    # DNS can still resolve these hostnames, but anyone reaching them over the
-    # open internet gets a 403.
+    # mesh (100.64.0.0/10, fd7a:115c:a1e0::/48) or on falcon_network/coolify
+    # (172.18.0.0/16, 172.19.0.0/16) - the latter two so containers on our own
+    # internal docker networks (e.g. pulsenode calling this router directly to
+    # reach api@internal) count as trusted the same way a tailnet peer does.
+    # Traefik is also joined to the coolify network (for routing to
+    # Coolify-managed containers), and Docker masquerades externally-arriving
+    # connections - including real tailnet traffic - through whichever of
+    # Traefik's networks ends up handling NAT, which can surface as the
+    # coolify bridge gateway (172.19.0.1) instead of the real source IP. So
+    # 172.19.0.0/16 needs the same trust as 172.18.0.0/16 for tailnet clients
+    # to reliably reach vpn-only routes. Public DNS can still resolve these
+    # hostnames, but anyone reaching them over the open internet gets a 403.
     vpn-only:
       ipAllowList:
         sourceRange:
           - "100.64.0.0/10"
           - "fd7a:115c:a1e0::/48"
           - "172.18.0.0/16"
+          - "172.19.0.0/16"