diff --git a/main.tf b/main.tf
index 1ed2a2b..cf03fe7 100644
--- a/main.tf
+++ b/main.tf
@@ -36,14 +36,6 @@ resource "hcloud_server" "vps" {
 resource "hcloud_firewall" "vps" {
   name = "${var.server_name}-firewall"
 
-  # SSH: Tailscale CGNAT range + explicit allowed IPs
-  rule {
-    direction   = "in"
-    protocol    = "tcp"
-    port        = "22"
-    source_ips  = var.tailscale_auth_key != "" ? concat(["100.64.0.0/10"], var.allowed_ssh_ips) : var.allowed_ssh_ips
-    description = "SSH access"
-  }
 
   # ICMP for diagnostics
   rule {