diff --git a/compose.yaml b/compose.yaml
index c152638..19ce8fc 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -1,7 +1,38 @@
 services:
+  # WireGuard VPN-Exit -> Hetzner wg2 (dedizierter Tunnel). SABnzbd teilt diesen Netzstack,
+  # damit der gesamte Usenet-Traffic ueber die Hetzner-IP rausgeht.
+  wireguard:
+    image: lscr.io/linuxserver/wireguard:latest
+    container_name: sabnzbd-wg
+    cap_add:
+      - NET_ADMIN
+      - SYS_MODULE
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Berlin
+    volumes:
+      - /app-config/sabnzbd/wg:/config
+      - /lib/modules:/lib/modules:ro
+    sysctls:
+      - net.ipv4.conf.all.src_valid_mark=1
+    ports:
+      - 7777:7777          # SABnzbd-WebUI laeuft im Netzstack dieses Containers
+    healthcheck:
+      test: ["CMD-SHELL", "wg show wg0 | grep -q 'latest handshake' || exit 1"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 20s
+    restart: unless-stopped
+
   sabnzbd:
     image: lscr.io/linuxserver/sabnzbd:latest
     container_name: sabnzbd
+    network_mode: "service:wireguard"
+    depends_on:
+      wireguard:
+        condition: service_healthy
     environment:
       - PUID=1000
       - PGID=1000
@@ -12,8 +43,6 @@ services:
       - tdarr:/tdarr
       - chris:/chris
       - /mnt/media:/data
-    ports:
-      - 7777:7777
     restart: unless-stopped
 
 volumes: