diff --git a/sys/machines/rackserv/fail2ban.nix b/sys/machines/rackserv/fail2ban.nix
index 644b181..128882d 100644
--- a/sys/machines/rackserv/fail2ban.nix
+++ b/sys/machines/rackserv/fail2ban.nix
@@ -1,4 +1,6 @@
 {
+  services.openssh.startWhenNeeded = false; # i dont think this works with fail2ban
+
   services.fail2ban = {
     enable = true;
     ignoreIP = ["100.64.0.0/10"]; # tailscale