diff --git a/terraform/firewall.tf b/terraform/firewall.tf
index 8919f3b..f8531a5 100644
--- a/terraform/firewall.tf
+++ b/terraform/firewall.tf
@@ -1,6 +1,6 @@
 locals {
-  ssh_source_ips = var.restrict_api_ssh_to_tailnet ? [var.tailnet_cidr] : var.allowed_ssh_ips
-  api_source_ips = var.restrict_api_ssh_to_tailnet ? [var.tailnet_cidr] : var.allowed_api_ips
+  ssh_source_ips = var.restrict_api_ssh_to_tailnet ? concat([var.tailnet_cidr], var.allowed_ssh_ips) : var.allowed_ssh_ips
+  api_source_ips = var.restrict_api_ssh_to_tailnet ? concat([var.tailnet_cidr], var.allowed_api_ips) : var.allowed_api_ips
 }
 
 resource "hcloud_firewall" "cluster" {