diff --git a/modules/nixos/nebula.nix b/modules/nixos/nebula.nix
index 5b398d2..135c517 100644
--- a/modules/nixos/nebula.nix
+++ b/modules/nixos/nebula.nix
@@ -162,10 +162,10 @@ in
       tun = {
         # Interface name
         device = "nebula0";
-        # unsafe_routes for hosts that need access to a non-Nebula subnet
-        unsafeRoutes = cfg.unsafeRoutes;
       };
 
+      settings.tun.unsafe_routes = map (r: { route = r.route; via = r.via; }) cfg.unsafeRoutes;
+
       # Firewall: permissive defaults — tighten per-host as desired
       firewall = {
         outbound = [