diff --git a/modules/server/caddy.nix b/modules/server/caddy.nix
index 7bcd7b6..db31a4e 100644
--- a/modules/server/caddy.nix
+++ b/modules/server/caddy.nix
@@ -16,14 +16,8 @@ let
     port = toString cfg.vaultwarden.port;
     wsPort = toString cfg.vaultwarden.websocketPort;
   in if vaultwardenEnabled then ''
-    handle_path /vault {
-      redir * /vault/
-    }
-
-    handle_path /vault/* {
-      reverse_proxy /notifications/hub/negotiate 127.0.0.1:${port}
-      reverse_proxy /notifications/hub 127.0.0.1:${wsPort}
-      reverse_proxy 127.0.0.1:${port} {
+    route /vault* {
+      reverse_proxy /vault/* 127.0.0.1:${port} {
         header_up X-Real-IP {remote_host}
       }
     }
@@ -47,7 +41,6 @@ let
 
   tailscaleConfig = if tailscaleEnabled then ''
     ${hostname}.${domain} {
-      bind tailscale0
       tls {
         protocols tls1.3
       }
diff --git a/modules/server/vaultwarden.nix b/modules/server/vaultwarden.nix
index 28a4454..d17ca26 100644
--- a/modules/server/vaultwarden.nix
+++ b/modules/server/vaultwarden.nix
@@ -18,12 +18,6 @@ in helpers.linuxAttrs {
       description = "Vaultwarden HTTP port.";
       type = types.port;
     };
-
-    websocketPort = mkOption {
-      default = 8001;
-      description = "Vaultwarden WebSocket port.";
-      type = types.port;
-    };
   };
 
   config = mkIf (cfg.enable && cfg.vaultwarden.enable) {
@@ -40,9 +34,9 @@ in helpers.linuxAttrs {
 
     services.vaultwarden = let
       baseURL = if (cfg.caddy.enable && cfg.tailscale.enable)
-        then "https://${hostname}.${cfg.tailscale.domain}/vault/"
-        else if cfg.caddy.enable then "http://${address}/vault/"
-        else "http://${address}:${toString cfg.vaultwarden.port}/vault/";
+        then "https://${hostname}.${cfg.tailscale.domain}/vault"
+        else if cfg.caddy.enable then "http://${address}/vault"
+        else "http://${address}:${toString cfg.vaultwarden.port}/vault";
     in {
       enable = true;
       dbBackend = "sqlite";
@@ -50,9 +44,7 @@ in helpers.linuxAttrs {
       config = {
         IP_HEADER = "X-Real-IP";
         DOMAIN = baseURL;
-        WEBSOCKET_ADDRESS = "127.0.0.1";
         ROCKET_ADDRESS = "127.0.0.1";
-        WEBSOCKET_PORT = toString cfg.vaultwarden.websocketPort;
         ROCKET_PORT = toString cfg.vaultwarden.port;
         ROCKET_LIMITS = "{json=10485760}";