diff --git a/flake.lock b/flake.lock
index 8c2189d..fd519c7 100644
--- a/flake.lock
+++ b/flake.lock
@@ -491,6 +491,22 @@
         "type": "github"
       }
     },
+    "nixpkgs-netbird": {
+      "locked": {
+        "lastModified": 1792502884,
+        "narHash": "sha256-IoNisKcGbUjdd45qCqywGMCYmZ5EnkxezvLII0FWwNA=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "02c087f3fe673c9e317f206a627cb6b910336dbe",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nixpkgs_2": {
       "locked": {
         "lastModified": 1788404924,
@@ -551,7 +567,8 @@
         "hjem": "hjem",
         "hjem-rum": "hjem-rum",
         "hyprland": "hyprland",
-        "nixpkgs": "nixpkgs_3"
+        "nixpkgs": "nixpkgs_3",
+        "nixpkgs-netbird": "nixpkgs-netbird"
       }
     },
     "systems": {
diff --git a/flake.nix b/flake.nix
index fb1ceef..364f057 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,6 +2,8 @@
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
 
+    nixpkgs-netbird.url = "github:nixos/nixpkgs/nixos-unstable";
+
     hyprland.url = "github:hyprwm/Hyprland";
     agenix.url = "github:ryantm/agenix";
 
diff --git a/hosts/goyplex-vm/custom.nix b/hosts/goyplex-vm/custom.nix
index 3f5bb75..3d0d3b5 100644
--- a/hosts/goyplex-vm/custom.nix
+++ b/hosts/goyplex-vm/custom.nix
@@ -1,8 +1,17 @@
 # per-host overrides: static IP for the k3s edge node
 # LAN: 10.0.1.0/24, gw 10.0.1.1, DNS pas 10.0.1.45 + 1.1.1.1
-{ ... }:
+{ inputs, pkgs, ... }:
 
 {
+  # netbird client from a fresher nixpkgs pin. The system nixpkgs (locked
+  # 2026-09-04) ships netbird 0.78.1 while the k3s server runs the floating
+  # 0.81.x image; that skew breaks network/exit-route pushes to this peer.
+  nixpkgs.overlays = [
+    (final: prev: {
+      netbird = inputs.nixpkgs-netbird.legacyPackages.${final.stdenv.hostPlatform.system}.netbird;
+    })
+  ];
+
   networking.networkmanager.ensureProfiles.environmentFiles = [ ];
   networking.networkmanager.ensureProfiles.profiles = {
     "ens18-static" = {