diff --git a/flake.lock b/flake.lock
index fdbcfd3..5880249 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2984,6 +2984,7 @@
         "ooknet-website": "ooknet-website",
         "ooks-scripts": "ooks-scripts",
         "systems": "systems_6",
+        "vpn-confinement": "vpn-confinement",
         "zjstatus": "zjstatus"
       }
     },
@@ -3150,6 +3151,21 @@
         "type": "github"
       }
     },
+    "vpn-confinement": {
+      "locked": {
+        "lastModified": 1731209328,
+        "narHash": "sha256-b3jggBHZh20jUfBxoaIvew23czsw82zBc0aKxtkF3g8=",
+        "owner": "Maroka-chan",
+        "repo": "VPN-Confinement",
+        "rev": "74e6fd47804b5ca69187200efbb14cf1ecb9ea07",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Maroka-chan",
+        "repo": "VPN-Confinement",
+        "type": "github"
+      }
+    },
     "xdph": {
       "inputs": {
         "hyprland-protocols": [
diff --git a/flake.nix b/flake.nix
index 4b9c24c..05fe767 100644
--- a/flake.nix
+++ b/flake.nix
@@ -37,6 +37,9 @@
 
     nvf.url = "github:notashelf/nvf/v0.7";
 
+    # confine vpns to specific systemd services
+    vpn-confinement.url = "github:Maroka-chan/VPN-Confinement";
+
     # hypr* ecosystem
     hyprland.url = "github:hyprwm/hyprland";