diff --git a/STATUS.md b/STATUS.md
index 0b0e6d3..c31be95 100644
--- a/STATUS.md
+++ b/STATUS.md
@@ -51,7 +51,7 @@ infrastructure, Proxmox cluster ops, and k8s control plane.
 - [x] Cyclades AlterPath PM10i (10 outlets) managed via powerman over serial
 - [x] USB-DB9 adapter (Prolific pl2303) with stable udev symlink
   `/dev/cyclades-pm10`
-- [x] powermand listening on `0.0.0.0:10101` (network-accessible)
+- [x] powermand listening on `127.0.0.1:10101` + Tailscale `100.121.189.98:10101`
 - [x] All 10 outlets defined as `outlet-1` through `outlet-10`
 - [x] Validated: outlet 10 cycled off → on (8/8 test checks passed)
 - [ ] Rename outlets to match physical devices (Friday onsite)
diff --git a/powerman/README.md b/powerman/README.md
index ac1c287..adcd136 100644
--- a/powerman/README.md
+++ b/powerman/README.md
@@ -13,7 +13,7 @@ Centralized power management for the Cyclades AlterPath PM10i PDU via
 | **Host** | pfv-tsys1 (OptiPlex 9020, Proxmox) |
 | **Serial** | 9600 baud, 8N1, raw mode |
 | **Credentials** | Factory defaults: `admin` / `pm8` (in cyclades-pm10.dev) |
-| **Network access** | powermand listens on `0.0.0.0:10101` |
+| **Network access** | powermand listens on `127.0.0.1:10101` (local) + `100.121.189.98:10101` (Tailscale) |
 
 ## Device mapping
 
diff --git a/powerman/setup.sh b/powerman/setup.sh
index d69ab84..df0658a 100644
--- a/powerman/setup.sh
+++ b/powerman/setup.sh
@@ -29,18 +29,31 @@ PDU_DEV_NAME="${PDU_DEV_NAME:-cyclades-pm10}"
 PDU_BAUD="${PDU_BAUD:-9600,8n1}"
 PDU_TYPE="${PDU_TYPE:-pm10}"
 PDU_OUTLETS="${PDU_OUTLETS:-10}"
-PDU_LISTEN="${PDU_LISTEN:-0.0.0.0:10101}"
+PDU_LISTEN="${PDU_LISTEN:-}"  # Auto-detect Tailscale IP if empty
 
 UDEV_RULE="/etc/udev/rules.d/99-cyclades-pdu.rules"
 POWERMAN_CONF="/etc/powerman/powerman.conf"
 DEV_FILE="/etc/powerman/cyclades-pm10.dev"
 
+# --- Auto-detect Tailscale IP for listen address ---
+if [ -z "$PDU_LISTEN" ]; then
+  TS_IP=$(tailscale ip -4 2>/dev/null || true)
+  if [ -n "$TS_IP" ]; then
+    PDU_LISTEN="${TS_IP}:10101"
+    echo "  Auto-detected Tailscale IP: $TS_IP"
+  else
+    PDU_LISTEN="127.0.0.1:10101"
+    echo "  WARNING: No Tailscale IP detected. Defaulting to localhost."
+  fi
+fi
+
 echo "============================================"
 echo "  Powerman PDU Setup"
 echo "  Host: $(hostname)"
 echo "  PDU:  Cyclades PM${PDU_OUTLETS}i"
 echo "  Adapter serial: $PDU_SERIAL"
 echo "  Device symlink: /dev/$PDU_DEV_NAME"
+echo "  Listen: $PDU_LISTEN (Tailscale only)"
 echo "============================================"
 
 # --- 1. Ensure powerman is installed ---
@@ -112,7 +125,8 @@ cat > "$POWERMAN_CONF" <<PMCONF
 # Generated by powerman/setup.sh on $(date)
 # Device: /dev/${PDU_DEV_NAME} (USB-DB9 adapter serial ${PDU_SERIAL})
 
-# Listen on all interfaces so PDU is manageable over the network
+# Listen on localhost (for local admin) and Tailscale (for remote access)
+listen "127.0.0.1:10101"
 listen "${PDU_LISTEN}"
 
 # Device specification for Cyclades PM10