diff --git a/flake.nix b/flake.nix
index f2ecc7f..ab39c42 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,6 +1,6 @@
 # flake for blakes nixos config
 # define new devices in outputs
-# generation: 125 current  2025-10-08 21:31:26  25.05.20251006.20c4598  6.12.50                          *
+# generation: 126 current  2025-10-08 22:04:52  25.05.20251006.20c4598  6.12.50                          *
 {
   description = "blakes nix config";
   inputs = {
diff --git a/hosts/snowbelle/configuration.nix b/hosts/snowbelle/configuration.nix
index 2337527..1f4666e 100644
--- a/hosts/snowbelle/configuration.nix
+++ b/hosts/snowbelle/configuration.nix
@@ -63,8 +63,20 @@
   networking = {
     hostName = "snowbelle"; # hostname
     hostId = "3e6e7055";    # zfs wants this
-    networkmanager.enable = true;  # the goat
-    networkmanager.dns = "systemd-resolved"; # the backup dancer!
+    networkmanager = {
+      enable = true;  # the goat
+      dns = "systemd-resolved"; # the backup dancer!
+      ensureProfiles.profiles = {
+        vpn = {
+          connection.type = "vlan";
+          connection.id = "vpn";
+          connection.interface-name = "enp89s0.69";   # or just "vpn-vlan"
+          vlan.parent = "enp89s0";
+          vlan.id = 69;
+          ipv4.never-default = true;  # prevent setting a default route
+        };
+      };
+    };
   };