diff --git a/modules/nixos/services/home-assistant/default.nix b/modules/nixos/services/home-assistant/default.nix
index 30e21cf..7f31e36 100644
--- a/modules/nixos/services/home-assistant/default.nix
+++ b/modules/nixos/services/home-assistant/default.nix
@@ -227,15 +227,26 @@ in
       virtualisation.oci-containers.containers.otbr = {
         image = "ghcr.io/ownbee/hass-otbr-docker:${cfg.otbr.version}";
 
+        # Upstream is emphatic that the border router needs full privileges and
+        # the host network, s6-overlay bails out early otherwise.
+        privileged = true;
         extraOptions = [ "--network=host" ];
         capabilities.NET_ADMIN = true;
-        capabilities.NET_RAW = true;
+        capabilities.SYS_ADMIN = true;
+
+        devices = [
+          "${otbrDevice}:${otbrDevice}"
+
+          # otbr-agent puts the Thread mesh behind a TUN interface.
+          "/dev/net/tun:/dev/net/tun"
+        ];
 
-        devices = [ "${otbrDevice}:/dev/ttyACM0" ];
-        volumes = [ "${cfg.path}/otbr:/var/lib/thread" ];
+        # The entrypoint symlinks /var/lib/thread at /data/thread, so mounting
+        # over /var/lib/thread would stop it from ever being created.
+        volumes = [ "${cfg.path}/otbr:/data/thread" ];
 
         environment = {
-          "DEVICE" = "/dev/ttyACM0";
+          "DEVICE" = otbrDevice;
           "BAUDRATE" = toString cfg.otbr.baudrate;
           "FLOW_CONTROL" = if cfg.otbr.flowControl then "1" else "0";
           "BACKBONE_IF" = cfg.otbr.backboneInterface;