diff --git a/kube/deploy/apps/readeck/app/hr.yaml b/kube/deploy/apps/readeck/app/hr.yaml
index 45a6d3b3..26eb9b30 100644
--- a/kube/deploy/apps/readeck/app/hr.yaml
+++ b/kube/deploy/apps/readeck/app/hr.yaml
@@ -22,6 +22,7 @@ spec:
           labels:
             ingress.home.arpa/nginx-internal: "allow"
             db.home.arpa/pg: "pg-default"
+            tailscale.com/expose: "true"
         containers:
           main:
             image: &img
@@ -78,7 +79,7 @@ spec:
         primary: false
         className: "tailscale"
         hosts:
-          - host: &ts "r"
+          - host: &ts "r.${DNS_TS}"
             paths: *path
         tls:
           - hosts: [*ts]