diff --git a/modules/home/programs/graphical/wms/hyprland/apps.nix b/modules/home/programs/graphical/wms/hyprland/apps.nix
index 91936e096..e3430c92b 100644
--- a/modules/home/programs/graphical/wms/hyprland/apps.nix
+++ b/modules/home/programs/graphical/wms/hyprland/apps.nix
@@ -43,6 +43,7 @@ in
           "${getExe pkgs.openrgb-with-all-plugins} --startminimized --profile default"
           "${getExe pkgs._1password-gui} --silent"
           "${getExe pkgs.tailscale-systray}"
+          "run-as-service $(${getExe pkgs.wayvnc} $(${getExe pkgs.tailscale} ip --4))"
         ];
       };
     };
diff --git a/modules/nixos/services/tailscale/default.nix b/modules/nixos/services/tailscale/default.nix
index 8d903bf78..3e373b779 100644
--- a/modules/nixos/services/tailscale/default.nix
+++ b/modules/nixos/services/tailscale/default.nix
@@ -45,6 +45,7 @@ in
     networking = {
       firewall = {
         allowedUDPPorts = [ config.services.tailscale.port ];
+        allowedTCPPorts = [ 5900 ];
         trustedInterfaces = [ config.services.tailscale.interfaceName ];
         # Strict reverse path filtering breaks Tailscale exit node use and some subnet routing setups.
         checkReversePath = "loose";