diff --git a/flake.lock b/flake.lock
index 6c12b81f9d23b1bedc5a2201d6aeb10113b9ced3..cce191d0fe35655bac5ad422283f287c04997178 100644
--- a/flake.lock
+++ b/flake.lock
@@ -654,7 +654,6 @@         "resume": "resume",
         "tailproxy": "tailproxy",
         "tclip": "tclip",
         "ugit": "ugit",
-        "vpn-confinement": "vpn-confinement",
         "website": "website"
       }
     },
@@ -853,21 +852,6 @@       },
       "original": {
         "owner": "numtide",
         "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "vpn-confinement": {
-      "locked": {
-        "lastModified": 1788035501,
-        "narHash": "sha256-3Xs9lCMwjvFURU7/fPEGDR5kCKvcdX2l5Fah1nZoaGQ=",
-        "owner": "Maroka-chan",
-        "repo": "VPN-Confinement",
-        "rev": "ce8949125b698406810ea71a8bd7b567d9a0b09f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Maroka-chan",
-        "repo": "VPN-Confinement",
         "type": "github"
       }
     },
diff --git a/flake.nix b/flake.nix
index d6857e274ab6e3df388467de5bd21ea648d0208d..6a1dc175e59ba0c6330a24f378a0885a905e11a1 100644
--- a/flake.nix
+++ b/flake.nix
@@ -29,7 +29,6 @@     foundry.url = "github:reckenrode/nix-foundryvtt";
     tailproxy.url = "git+https://git.jolheiser.com/tailroute.git";
     forge-lines.url = "git+https://code.winston.sh/winston/forge-lines.git";
     mazanoke.url = "github:jolheiser/mazanoke-nix";
-    vpn-confinement.url = "github:Maroka-chan/VPN-Confinement";
   };
 
   outputs =
@@ -73,7 +72,6 @@         ];
         gunpowder.imports = [
           inputs.agenix.nixosModules.default
           inputs.tailproxy.nixosModules.default
-          inputs.vpn-confinement.nixosModules.default
           ./common
           ./gunpowder
         ];
diff --git a/gunpowder/services/mullvad.nix b/gunpowder/services/mullvad.nix
new file mode 100644
index 0000000000000000000000000000000000000000..c3699a7b3e7dc861eb365c995dbd15ebec2abe60
--- /dev/null
+++ b/gunpowder/services/mullvad.nix
@@ -0,0 +1,27 @@
+{ lib, config, ... }:
+let
+  enable = true;
+in
+lib.mkIf enable {
+  age.secrets.mullvad.file = ../../secrets/mullvad.age;
+
+  services.mullvad-vpn.enable = true;
+
+  systemd.services.mullvad-provision = {
+    description = "Log in to Mullvad and keep it connected";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "mullvad-daemon.service" ];
+    requires = [ "mullvad-daemon.service" ];
+    path = [ config.services.mullvad-vpn.package ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      until mullvad status >/dev/null 2>&1; do sleep 1; done
+      mullvad account login "$(cat ${config.age.secrets.mullvad.path})"
+      mullvad auto-connect set on
+      mullvad connect
+    '';
+  };
+}
diff --git a/gunpowder/services/qbittorrent.nix b/gunpowder/services/qbittorrent.nix
index bdf08393b9902166621c90bb3879ae79fddcf444..e4b74bfbb2615624cadcc1d8995227c01d7cd2b1 100644
--- a/gunpowder/services/qbittorrent.nix
+++ b/gunpowder/services/qbittorrent.nix
@@ -1,38 +1,51 @@
-{ lib, config, ... }:
+{ lib, pkgs, ... }:
 let
   enable = true;
   port = 7248;
+
+  mullvadBypassMark = "0x6d6f6c65";
+  mullvadBypassCtMark = "0x00000f41";
+
+  ruleset = pkgs.writeText "qbittorrent-mullvad-scope.nft" ''
+    table inet qbittorrent_mullvad_scope {
+      chain output {
+        type route hook output priority 0; policy accept;
+        meta skuid != "qbittorrent" meta mark set ${mullvadBypassMark} ct mark set ${mullvadBypassCtMark}
+        meta skuid "qbittorrent" oifname != "wg-mullvad" oifname != "lo" drop
+      }
+    }
+  '';
 in
 lib.mkIf enable {
-  age.secrets.mullvad.file = ../../secrets/mullvad.age;
-
-  vpnNamespaces.mullvad = {
-    enable = true;
-    wireguardConfigFile = config.age.secrets.mullvad.path;
-    portMappings = [
-      {
-        from = port;
-        to = port;
-      }
-    ];
-  };
-
-  systemd.services.qbittorrent.vpnConfinement = {
-    enable = true;
-    vpnNamespace = "mullvad";
-  };
-
   services = {
     qbittorrent = {
       enable = true;
+      openFirewall = true;
       webuiPort = port;
     };
     tailproxy.qbittorrent = {
       enable = true;
       hostname = "qbittorrent";
-      host = config.vpnNamespaces.mullvad.namespaceAddress;
       inherit port;
       authKey = "tskey-auth-kV7j5FHHHh11CNTRL-wPSNdNQqza8kXxzpnZXha8B7JCvdwCAy"; # One-time key
+    };
+  };
+
+  systemd.services.qbittorrent-mullvad-scope = {
+    description = "Scope the Mullvad tunnel to qBittorrent only";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network-pre.target" ];
+    before = [
+      "qbittorrent.service"
+      "mullvad-daemon.service"
+    ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStart = pkgs.writeShellScript "qbittorrent-mullvad-scope-start" ''
+        ${pkgs.nftables}/bin/nft delete table inet qbittorrent_mullvad_scope 2>/dev/null || true
+        ${pkgs.nftables}/bin/nft -f ${ruleset}
+      '';
     };
   };
 }
diff --git a/secrets/mullvad.age b/secrets/mullvad.age
index 04dbeebcad3662a22caa44e2b281ef09b4be9119..0ba002c8108c920fc79e250873a2ea897028a7c5 100644
Binary files a/secrets/mullvad.age and b/secrets/mullvad.age differ