diff --git a/tailscale-proxy/docker-compose.yaml b/tailscale-proxy/docker-compose.yaml
index 1b9c971..293c7da 100644
--- a/tailscale-proxy/docker-compose.yaml
+++ b/tailscale-proxy/docker-compose.yaml
@@ -47,6 +47,13 @@ services:
     image: ghcr.io/telemt/telemt:3.4.25
     container_name: ts-lan-telemt
     restart: unless-stopped
+    # Docker default soft nofile is 1024. A connection flood on the public :1080
+    # exhausted it on 2026-09-09 and accept() then failed for EVERY caller, for
+    # ~8 minutes. Steady state needs only ~45-73 descriptors.
+    ulimits:
+      nofile:
+        soft: 65536
+        hard: 524288
     depends_on: [ts-proxy]
     environment:
       NO_COLOR: "1"                # cleaner `docker logs` (no ANSI escapes)
diff --git a/tailscale-proxy/telemt/telemt.toml.example b/tailscale-proxy/telemt/telemt.toml.example
index 1645eea..d87d7c1 100644
--- a/tailscale-proxy/telemt/telemt.toml.example
+++ b/tailscale-proxy/telemt/telemt.toml.example
@@ -15,6 +15,12 @@
 [general]
 use_middle_proxy = false
 
+# Scanners/DPI probes that never complete the Fake-TLS handshake leave orphaned
+# sockets in FIN-WAIT-1. "errors" sets SO_LINGER(0) at accept() and CLEARS it once
+# a client authenticates, so real sessions still close gracefully with FIN and only
+# pre-auth closes get an RST. Applied at 02-tekhnohim 2026-09-09.
+rst_on_close = "errors"
+
 [general.modes]
 classic = false
 secure = false