diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 3b3b6fd..834275b 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -10,7 +10,7 @@
 		"context": ".",
 		"dockerfile": "Dockerfile"
 	},
-	"postCreateCommand": "bun install",
+	"postCreateCommand": "bun install && ./scripts/setup-tailscale.sh",
 	"postStartCommand": "./scripts/setup-git.sh && ./scripts/setup-nvim.sh",
 	// Features add additional features to your environment. See https://containers.dev/features
 	// Beware: features are not supported on all platforms and may have unintended side-effects.
diff --git a/scripts/setup-tailscale.sh b/scripts/setup-tailscale.sh
new file mode 100755
index 0000000..f3b8a12
--- /dev/null
+++ b/scripts/setup-tailscale.sh
@@ -0,0 +1,21 @@
+#!/bin/bash
+
+# Tailscale setup script
+# Authenticates with Tailscale if TS_AUTH_KEY is set and Tailscale is not already logged in
+
+set -e
+
+if [ -z "$TS_AUTH_KEY" ]; then
+    echo "TS_AUTH_KEY is not set, skipping Tailscale login."
+    exit 0
+fi
+
+STATUS=$(tailscale status 2>&1 || true)
+
+if echo "$STATUS" | grep -qi "logged out\|stopped"; then
+    echo "Tailscale is not authenticated. Logging in..."
+    sudo tailscale up --accept-routes --auth-key="$TS_AUTH_KEY"
+    echo "Tailscale login complete."
+else
+    echo "Tailscale is already authenticated, skipping."
+fi