diff --git a/servers/legion/main.tf b/servers/legion/main.tf
index 89c9836..cd83305 100644
--- a/servers/legion/main.tf
+++ b/servers/legion/main.tf
@@ -172,12 +172,11 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "legion" {
     }
 
     # vpn.neuralplatform.ai — Headscale coordination server (Tailscale control plane)
+    # Route directly to Headscale — bypasses Traefik which strips the Upgrade: ts2021 header
+    # Cloudflare handles TLS termination; internal connection is plain HTTP
     ingress_rule {
       hostname = "vpn.neuralplatform.ai"
-      service  = "https://traefik.kube-system.svc:443"
-      origin_request {
-        no_tls_verify = true
-      }
+      service  = "http://headscale.headscale.svc.cluster.local:8080"
     }
 
     # Catch-all — must be last