diff --git a/ansible/services/headscale/deploy_headscale_playbook.yml b/ansible/services/headscale/deploy_headscale_playbook.yml
index fe3a225..29de9b6 100644
--- a/ansible/services/headscale/deploy_headscale_playbook.yml
+++ b/ansible/services/headscale/deploy_headscale_playbook.yml
@@ -244,23 +244,9 @@
       vars:
         caddy_site_name: headscale
         caddy_site_domain: "{{ headscale_domain }}"
-        # Raw body, and it must stay raw: the /admin* route in front of
-        # Headplane is not expressible as a plain reverse_proxy. The previous
-        # version of this task wrote only `reverse_proxy localhost:8080`, which
-        # would have deleted the admin route and its auth on the next run.
-        caddy_site_body: |
-          @headplane {
-              path /admin*
-          }
-          handle @headplane {
-              basicauth {
-                  {{ headscale_ui_username }} {{ headscale_ui_password_hash }}
-              }
-              reverse_proxy http://localhost:{{ headplane_port }}
-          }
-          # Headscale API is protected by its own API key authentication
-          # All API operations require a valid Bearer token in the Authorization header
-          reverse_proxy * http://localhost:{{ headscale_port }}
+        # The Headscale API authenticates every request itself (Bearer API
+        # key), so a plain proxy is all it needs.
+        caddy_site_upstream: "localhost:{{ headscale_port }}"
 
   handlers:
     - name: Restart headscale
diff --git a/ansible/services/headscale/headscale_vars.yml b/ansible/services/headscale/headscale_vars.yml
index c3fb948..7118cc7 100644
--- a/ansible/services/headscale/headscale_vars.yml
+++ b/ansible/services/headscale/headscale_vars.yml
@@ -18,6 +18,3 @@ remote_host: "{{ hostvars.get(remote_host_name, {}).get('ansible_host', remote_h
 remote_user: "{{ hostvars.get(remote_host_name, {}).get('ansible_user', 'counterweight') }}"
 remote_key_file: "{{ hostvars.get(remote_host_name, {}).get('ansible_ssh_private_key_file', '') }}"
 remote_port: "{{ hostvars.get(remote_host_name, {}).get('ansible_port', 22) }}"
-
-# Headplane (headscale admin UI), proxied at /admin* behind Caddy basic auth
-headplane_port: 3000