diff --git a/fly/Dockerfile b/fly/Dockerfile
index 09099c4..65135c1 100644
--- a/fly/Dockerfile
+++ b/fly/Dockerfile
@@ -9,7 +9,8 @@ COPY --from=docker.io/tailscale/tailscale:stable \
 RUN mkdir -p /var/run/tailscale /var/lib/tailscale \
     && apk add --no-cache iptables ip6tables \
     && apk add --no-cache libc6-compat \
-    && apk add --no-cache fail2ban
+    && apk add --no-cache fail2ban \
+    && rm -f /etc/fail2ban/jail.d/alpine-ssh.conf
 
 # Copy Alloy binary from official image (Ubuntu-based, needs libc6-compat)
 COPY --from=docker.io/grafana/alloy:v1.13.1 \
diff --git a/fly/fail2ban/jail.d/forge.conf b/fly/fail2ban/jail.d/forge.conf
index 50be379..7b0843f 100644
--- a/fly/fail2ban/jail.d/forge.conf
+++ b/fly/fail2ban/jail.d/forge.conf
@@ -1,7 +1,3 @@
-# Disable all default jails — this container has no SSH, mail, etc.
-[DEFAULT]
-enabled = false
-
 [forge-login]
 enabled  = true
 filter   = forge-login