diff --git a/nix/modules/gebos-caddy.nix b/nix/modules/gebos-caddy.nix
index e8ed7a7..bfa18d7 100644
--- a/nix/modules/gebos-caddy.nix
+++ b/nix/modules/gebos-caddy.nix
@@ -59,13 +59,15 @@ let
     }
   '';
 
-  # Caddyfile global options block must come first and exist once; we fold every
-  # layer4 listener into a single `layer4 { ... }` inside it.
-  globalOptions = lib.optionalString needsLayer4 ''
-    {
-    	layer4 {
+  # caddy-l4 listeners, folded into one `layer4` directive that lives INSIDE the
+  # Caddyfile global options block. We must NOT emit our own `{ }` block here:
+  # the NixOS caddy module already generates the single global block (for
+  # `email`), and a second keyless block is invalid ("server block without any
+  # key is global configuration, and if used, it must be first"). So this goes to
+  # services.caddy.globalConfig, which the module places inside that one block.
+  layer4Global = lib.optionalString needsLayer4 ''
+    layer4 {
     ${lib.concatStrings (lib.mapAttrsToList layer4Listener tcpProxySites)}	}
-    }
   '';
 in
 {
@@ -82,9 +84,9 @@ in
       enable = true;
       package = if needsLayer4 then caddyWithL4 else pkgs.caddy;
       email = "ops@gebos.online";  # TODO: confirm ACME contact
+      globalConfig = layer4Global;
       extraConfig = lib.concatStringsSep "\n" (
-        [ globalOptions ]
-        ++ lib.mapAttrsToList httpSiteBlock httpSites
+        lib.mapAttrsToList httpSiteBlock httpSites
         ++ lib.mapAttrsToList certSiteBlock tcpProxySites
       );
     };