diff --git a/services/headscale/config-template.yaml.j2 b/services/headscale/config-template.yaml.j2
index aaa7a0f..7e5260d 100644
--- a/services/headscale/config-template.yaml.j2
+++ b/services/headscale/config-template.yaml.j2
@@ -137,7 +137,10 @@ derp:
 disable_check_updates: false
 
 # Time before an inactive ephemeral node is deleted?
-ephemeral_node_inactivity_timeout: 30m
+# ephemeral_node_inactivity_timeout: 30m
+node:
+  ephemeral:
+    inactivity_timeout: 30m
 
 database:
   # Database type. Available options: sqlite, postgres
@@ -398,8 +401,3 @@ logtail:
   # As there is currently no support for overriding the log server in headscale, this is
   # disabled by default. Enabling this will make your clients send logs to Tailscale Inc.
   enabled: false
-
-# Enabling this option makes devices prefer a random port for WireGuard traffic over the
-# default static port 41641. This option is intended as a workaround for some buggy
-# firewall devices. See https://tailscale.com/kb/1181/firewalls/ for more information.
-randomize_client_port: false