diff --git a/home/termux.nix b/home/termux.nix
index 1941f94..772bece 100644
--- a/home/termux.nix
+++ b/home/termux.nix
@@ -62,6 +62,10 @@
       ".ssh/authorized_keys".text = ''
         ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKduJia+unaQQdN6X5syaHvnpIutO+yZwvfiCP4qKQ/P
       '';
+      # nix-on-droid's session-init adds ~/.nix-defexpr/channels to NIX_PATH
+      # unconditionally; nix warns about the missing dir on every invocation.
+      # Making it exist silences the warning.
+      ".nix-defexpr/channels/nixpkgs/.keep".text = "";
     };
   };
   programs = {
@@ -106,7 +110,7 @@
         z-proxy = "export ALL_PROXY=socks5://localhost:10808";
         zh-proxy = "export HTTPS_PROXY=http://localhost:10808 && export HTTP_PROXY=http://localhost:10808";
         nix-dir = "cd ~/.config/nix-on-droid";
-        q-ssh = "sshd-start";
+        q-ssh = "sv-start"; # start all supervised services (sshd, tailscaled, ...); manage with `sv status sshd` etc
 
         # beets
         beet-ima = "beet im ./ -A";
diff --git a/modules/termux/default.nix b/modules/termux/default.nix
index faed463..1559d80 100644
--- a/modules/termux/default.nix
+++ b/modules/termux/default.nix
@@ -8,6 +8,30 @@ let
   sshdDir = "${config.user.home}/sshd";
   sshdTmpDir = "${config.user.home}/sshd-tmp";
   port = 8022;
+  serviceDir = "${config.user.home}/service";
+  tailscaleState = "${config.user.home}/tailscale/tailscaled.state";
+
+  # runit run-scripts (executable store paths, linked into ~/service).
+  sshdRun = pkgs.writeScriptBin "sshd-run" ''
+    #!${pkgs.runtimeShell}
+    exec ${pkgs.openssh}/bin/sshd -f /etc/ssh/sshd_config -D
+  '';
+  tailscaledRun = pkgs.writeScriptBin "tailscaled-run" ''
+    #!${pkgs.runtimeShell}
+    # real tun: requires /dev/net/tun access (root: su -c 'chmod 666 /dev/net/tun').
+    # If unavailable, fall back to userspace networking:
+    #   exec ${pkgs.tailscale}/bin/tailscaled --tun=userspace-networking --socks5-server=localhost:1055 --state=${tailscaleState}
+    exec ${pkgs.tailscale}/bin/tailscaled --state=${tailscaleState}
+  '';
+  svLogRun = pkgs.writeScriptBin "sv-log-run" ''
+    #!${pkgs.runtimeShell}
+    mkdir -p ./main
+    exec ${pkgs.runit}/bin/svlogd -tt ./main
+  '';
+  svStart = pkgs.writeScriptBin "sv-start" ''
+    #!${pkgs.runtimeShell}
+    exec ${pkgs.runit}/bin/runsvdir ${serviceDir}
+  '';
 in
 {
   # Minimal sshd server for LAN access (e.g. `ssh epral` from other hosts).
@@ -33,7 +57,26 @@ in
     fi
   '';
 
+  # runit service tree: ~/service/<name>/{run,log/run}. run/ and log/run are
+  # symlinks into the nix store (read-only is fine; runsvdir writes only to
+  # the <name>/supervise dirs). /etc/service is symlinked for `sv status`.
+  build.activation.services = ''
+    $DRY_RUN_CMD mkdir -p ${serviceDir}/sshd/log ${serviceDir}/tailscaled/log
+    $DRY_RUN_CMD ln -sfn ${sshdRun}/bin/sshd-run ${serviceDir}/sshd/run
+    $DRY_RUN_CMD ln -sfn ${svLogRun}/bin/sv-log-run ${serviceDir}/sshd/log/run
+    $DRY_RUN_CMD ln -sfn ${tailscaledRun}/bin/tailscaled-run ${serviceDir}/tailscaled/run
+    $DRY_RUN_CMD ln -sfn ${svLogRun}/bin/sv-log-run ${serviceDir}/tailscaled/log/run
+    $DRY_RUN_CMD ln -sfn ${serviceDir} /etc/service
+  '';
+
   environment.packages = [
+    pkgs.runit
+    pkgs.tailscale
+
+    # one command brings up all supervised services (sshd, tailscaled, ...)
+    svStart
+
+    # manual fallback for sshd only
     (pkgs.writeScriptBin "sshd-start" ''
       #!${pkgs.runtimeShell}
       exec ${pkgs.openssh}/bin/sshd -f /etc/ssh/sshd_config -D "$@"