diff --git a/tailscale/config.yaml b/tailscale/config.yaml
index 05147492..dee65fa8 100644
--- a/tailscale/config.yaml
+++ b/tailscale/config.yaml
@@ -19,6 +19,11 @@ arch:
 init: false
 hassio_api: true
 host_network: true
+privileged:
+  - NET_ADMIN
+  - NET_RAW
+devices:
+  - /dev/net/tun
 map:
   - share:rw
 schema:
diff --git a/tailscale/rootfs/etc/s6-overlay/s6-rc.d/tailscaled/run b/tailscale/rootfs/etc/s6-overlay/s6-rc.d/tailscaled/run
index df3ffc4c..fb452fb6 100755
--- a/tailscale/rootfs/etc/s6-overlay/s6-rc.d/tailscaled/run
+++ b/tailscale/rootfs/etc/s6-overlay/s6-rc.d/tailscaled/run
@@ -13,7 +13,6 @@ options+=(--statedir=/data/state)
 
 # Opt out of client log upload to log.tailscale.io
 options+=(--no-logs-no-support)
-options+=(--tun=userspace-networking)
 
 # Run Tailscale
 if bashio::debug ; then