diff --git a/home/pass.nix b/home/pass.nix
index bdd5b62..859580b 100644
--- a/home/pass.nix
+++ b/home/pass.nix
@@ -16,8 +16,7 @@
   # GPG agent settings (only for GPG/pass, NOT for SSH)
   services.gpg-agent = {
     enable = true;
-    # Never cache GPG passphrases: pass asks every time.
-    defaultCacheTtl = 0;
-    maxCacheTtl = 0;
+    defaultCacheTtl = 600;
+    maxCacheTtl = 600;
   };
 }
diff --git a/hosts/heather/astrnet.nix b/hosts/heather/astrnet.nix
index bc1a805..1113df1 100644
--- a/hosts/heather/astrnet.nix
+++ b/hosts/heather/astrnet.nix
@@ -33,10 +33,6 @@ let
   # to reach their own endpoints through the mesh default).
   wanTable = "100";
   wgMark = "0x4d49";
-  # Mark only WAN connections forwarded to published Docker ports. Their
-  # replies originate from a container, so the `from wanIp4` rule cannot
-  # select the WAN until after routing/NAT. Restore wgMark on the reply.
-  dockerInboundMark = "0x4d4a";
   wanRules =
     [ { fam = "-4"; sel = "fwmark ${wgMark}"; }
       { fam = "-4"; sel = "from ${wanIp4}"; }
@@ -97,12 +93,6 @@ in {
       nft list table inet astrnet_guard >/dev/null 2>&1 && nft delete table inet astrnet_guard
       nft -f - <<'RULES'
       table inet astrnet_guard {
-        chain prerouting {
-          type filter hook prerouting priority -150; policy accept;
-          # Reply packets from Docker inherit the connection mark before the
-          # routing decision; only public-WAN inbound connections get this mark.
-          iifname "br-*" ct mark ${dockerInboundMark} meta mark set ${wgMark}
-        }
         chain input {
           type filter hook input priority -150; policy accept;
           # Full inbound access from AstrNet to Heather, IPv4 and IPv6.
@@ -112,12 +102,7 @@ in {
         }
         chain forward {
           type filter hook forward priority -150; policy accept;
-          # A public connection DNATed by Docker must return via the public WAN,
-          # not the AstrNet default. This does not affect Docker-originated egress.
-          iifname "enp7s0" oifname "br-*" ct status dnat ct mark set ${dockerInboundMark}
-          # Allow mesh peers to reach only Docker-published ports (DNAT), not
-          # arbitrary forwarded destinations. Host services use the input chain.
-          iifname { "wg-mic-der", "wg-mic-bd8" } oifname "br-*" ct status dnat accept
+          # Only replies to Docker-initiated connections, never new mesh transit.
           iifname { "wg-mic-der", "wg-mic-bd8" } ct state established,related accept
           iifname { "wg-mic-der", "wg-mic-bd8" } drop
         }