diff --git a/docs/changelog.d/+pin-tailscale-fly.bugfix.md b/docs/changelog.d/+pin-tailscale-fly.bugfix.md
new file mode 100644
index 0000000..59f1e30
--- /dev/null
+++ b/docs/changelog.d/+pin-tailscale-fly.bugfix.md
@@ -0,0 +1 @@
+Pin Fly.io proxy Tailscale to v1.94.1 — the `:stable` tag pulled v1.96.5 which has a MagicDNS regression (SERVFAIL on tailnet names), breaking all public routing through forge.eblu.me, docs.eblu.me, and cv.eblu.me.
diff --git a/fly/Dockerfile b/fly/Dockerfile
index 3f866fa..8a6df31 100644
--- a/fly/Dockerfile
+++ b/fly/Dockerfile
@@ -1,9 +1,9 @@
 FROM nginx:1.29.6-alpine
 
 # Copy tailscale binaries from official image
-COPY --from=docker.io/tailscale/tailscale:stable \
+COPY --from=docker.io/tailscale/tailscale:v1.94.1 \
     /usr/local/bin/tailscaled /usr/local/bin/tailscaled
-COPY --from=docker.io/tailscale/tailscale:stable \
+COPY --from=docker.io/tailscale/tailscale:v1.94.1 \
     /usr/local/bin/tailscale /usr/local/bin/tailscale
 
 RUN mkdir -p /var/run/tailscale /var/lib/tailscale \