diff --git a/kiosk.nix b/kiosk.nix
index 2322757..13e6018 100644
--- a/kiosk.nix
+++ b/kiosk.nix
@@ -58,7 +58,7 @@ in
     enable = true;
     extraUpFlags = [ "--advertise-tags" "tag:kiosk" ];
     authKeyFile = ./tailscale-client-secret.key;
-    authKeyParameters.ephemeral = false;
+    authKeyParameters.ephemeral = true;
     openFirewall = true;
   };
   networking.firewall.trustedInterfaces = [ "tailscale0" ];