diff --git a/docs/server-build/tailscale.md b/docs/server-build/tailscale.md
index 216c22f..ef7f0ee 100644
--- a/docs/server-build/tailscale.md
+++ b/docs/server-build/tailscale.md
@@ -97,7 +97,41 @@ tailscale up --accept-dns=false
 - No dependency on LAN reachability
 - Accept the `tailscaled` dependency (if the tunnel is down, you're off-network anyway)
 
-## 6. Known items / future work
+## 6. Subnet router HA (redundant routing)
+
+> **Redmine:** [#377](https://projects.knownelement.com/issues/377)
+
+Both DNS nodes advertise the LAN subnet as Tailscale subnet routes,
+providing automatic failover for remote monitoring (Uptime Kuma on the
+Cloudron VPS) and off-site access:
+
+| Node | Tailscale IP | Advertised route | Role |
+|------|-------------|-----------------|------|
+| pfv-netinfra-01 | 100.70.181.72 | 192.168.0.0/22 | Primary subnet router + exit node |
+| pfv-netinfra-02 | 100.71.171.20 | 192.168.0.0/22 | Secondary subnet router (failover) |
+
+To configure on a node:
+```bash
+sudo tailscale set --advertise-routes=192.168.0.0/22
+```
+
+**Both routes must be approved** in the Tailscale admin console
+(https://login.tailscale.com/admin/machines) for failover to activate.
+Tailscale uses the primary router by default and fails over to the
+secondary if the primary's tunnel drops.
+
+### Known instability factors (2026-08-06, [#377])
+
+- **DERP relay bouncing:** netinfra-01 was observed switching between DERP
+  relays (#9, #12, #13) every ~15 minutes, causing brief tunnel disruptions.
+- **Docker LinkChange events:** container create/destroy adds/removes bridge
+  interfaces, triggering `LinkChange: major, rebinding` in tailscaled and
+  momentarily dropping all connections.
+- **resolv.conf immutable flag:** netinfra-01 had the `+i` (immutable)
+  attribute on `/etc/resolv.conf`, preventing tailscaled from updating DNS
+  config after link changes. Fixed by `chattr -i /etc/resolv.conf`.
+
+## 7. Known items / future work
 
 1. **Pi-hole upstream configuration.** Pi-hole on both hosts should forward
    to the local Technitium instance (port 5300) for `knel.net` and to an