diff --git a/README.md b/README.md
index f8cb653..8d01087 100644
--- a/README.md
+++ b/README.md
@@ -212,13 +212,17 @@ tofu -chdir=bootstrap/cluster apply \
   -var-file="$PWD/.lab/cluster-workers.auto.tfvars.json"
 ```
 
-Worker Tailscale defaults to `--accept-routes=true` and enables pod egress SNAT
-from the Kubernetes pod CIDR to `tailscale0`, so pods on Pimox workers can reach
-tailnet-only services. Override with
-`LAB_PIMOX_WORKER_TAILSCALE_ACCEPT_ROUTES=false` or
-`LAB_PIMOX_WORKER_TAILSCALE_POD_EGRESS_SNAT=false` when that behavior is not
-wanted. `./jeannie doctor-cluster` checks Pimox worker tailnet egress
-against `${LAB_PIMOX_WORKER_TAILNET_PROBE_HOST:-LAB_DEBIAN_TAILSCALE_IP}` and
+Worker Tailscale defaults to `--accept-routes=false` because these VMs already
+live on the homelab LAN; accepting an advertised `192.168.100.0/24` route can
+steal their local LAN route and break SSH or MetalLB traffic. Pod egress SNAT
+from the Kubernetes pod CIDR to `tailscale0` stays enabled, so pods on Pimox
+workers can reach tailnet-only services. Set
+`LAB_PIMOX_WORKER_TAILSCALE_ACCEPT_ROUTES=true` only when the worker must consume
+tailnet-advertised routes that do not overlap the local LAN. Set
+`LAB_PIMOX_WORKER_TAILSCALE_POD_EGRESS_SNAT=false` when pod egress through
+`tailscale0` is not wanted. `./jeannie doctor-cluster` checks Pimox
+worker tailnet egress against
+`${LAB_PIMOX_WORKER_TAILNET_PROBE_HOST:-LAB_DEBIAN_TAILSCALE_IP}` and
 `${LAB_PIMOX_WORKER_TAILNET_PROBE_PORT:-LAB_GITEA_HTTP_PORT}`.
 
 OpenWrt firewall VM automation is available as a standalone command because it
diff --git a/README.md.tmpl b/README.md.tmpl
index de8b99b..167f991 100644
--- a/README.md.tmpl
+++ b/README.md.tmpl
@@ -212,13 +212,17 @@ tofu -chdir=bootstrap/cluster apply \
   -var-file="$PWD/.lab/cluster-workers.auto.tfvars.json"
 ```
 
-Worker Tailscale defaults to `--accept-routes=true` and enables pod egress SNAT
-from the Kubernetes pod CIDR to `tailscale0`, so pods on Pimox workers can reach
-tailnet-only services. Override with
-`LAB_PIMOX_WORKER_TAILSCALE_ACCEPT_ROUTES=false` or
-`LAB_PIMOX_WORKER_TAILSCALE_POD_EGRESS_SNAT=false` when that behavior is not
-wanted. `./{{ main_script }} doctor-cluster` checks Pimox worker tailnet egress
-against `${LAB_PIMOX_WORKER_TAILNET_PROBE_HOST:-LAB_DEBIAN_TAILSCALE_IP}` and
+Worker Tailscale defaults to `--accept-routes=false` because these VMs already
+live on the homelab LAN; accepting an advertised `192.168.100.0/24` route can
+steal their local LAN route and break SSH or MetalLB traffic. Pod egress SNAT
+from the Kubernetes pod CIDR to `tailscale0` stays enabled, so pods on Pimox
+workers can reach tailnet-only services. Set
+`LAB_PIMOX_WORKER_TAILSCALE_ACCEPT_ROUTES=true` only when the worker must consume
+tailnet-advertised routes that do not overlap the local LAN. Set
+`LAB_PIMOX_WORKER_TAILSCALE_POD_EGRESS_SNAT=false` when pod egress through
+`tailscale0` is not wanted. `./{{ main_script }} doctor-cluster` checks Pimox
+worker tailnet egress against
+`${LAB_PIMOX_WORKER_TAILNET_PROBE_HOST:-LAB_DEBIAN_TAILSCALE_IP}` and
 `${LAB_PIMOX_WORKER_TAILNET_PROBE_PORT:-LAB_GITEA_HTTP_PORT}`.
 
 OpenWrt firewall VM automation is available as a standalone command because it
diff --git a/bootstrap/cluster/variables.tf b/bootstrap/cluster/variables.tf
index 10f4065..b32b336 100644
--- a/bootstrap/cluster/variables.tf
+++ b/bootstrap/cluster/variables.tf
@@ -86,7 +86,7 @@ variable "worker_tailscale_enabled" {
 
 variable "worker_tailscale_accept_routes" {
   type    = bool
-  default = true
+  default = false
 }
 
 variable "worker_tailscale_pod_egress_snat" {
diff --git a/scripts/workers b/scripts/workers
index ebbae86..fec69af 100755
--- a/scripts/workers
+++ b/scripts/workers
@@ -208,7 +208,7 @@ tailnet_setup() {
     local var_file="${LAB_CLUSTER_VAR_FILE:-${REPO_ROOT}/.lab/cluster-workers.auto.tfvars.json}"
     local auth_key_file="${LAB_PIMOX_WORKER_TAILSCALE_AUTH_KEY_FILE:-${HOME}/.config/homelab/tailscale-pimox-worker.authkey}"
     local worker_key_prefix="${LAB_PIMOX_WORKER_KEY_PREFIX:-pimox}"
-    local accept_routes="${LAB_PIMOX_WORKER_TAILSCALE_ACCEPT_ROUTES:-true}"
+    local accept_routes="${LAB_PIMOX_WORKER_TAILSCALE_ACCEPT_ROUTES:-false}"
     local pod_egress_snat="${LAB_PIMOX_WORKER_TAILSCALE_POD_EGRESS_SNAT:-true}"
     local keys=()
     local key