diff --git a/dotfiles/.config/quickshell/config/VpnExclusivity.qml b/dotfiles/.config/quickshell/config/VpnExclusivity.qml
new file mode 100644
index 0000000..1859446
--- /dev/null
+++ b/dotfiles/.config/quickshell/config/VpnExclusivity.qml
@@ -0,0 +1,16 @@
+pragma Singleton
+import QtQuick
+
+// Tailscale, Mullvad, and ProtonVPN all fight over the default route/DNS if
+// more than one is active at once (see VpnIndicator.qml's header comment) —
+// only one of the three should ever actually be connected. This singleton
+// is the shared signal between the two widget files: VpnIndicator.qml
+// writes Mullvad/ProtonVPN's live connection state here as it polls them;
+// TailscaleIndicator.qml reads it to back off (`tailscale down`) rather
+// than stay up alongside either one, and to refuse turning Tailscale back
+// on while one is still connected.
+QtObject {
+    property bool mullvadConnected: false
+    property bool protonConnected: false
+    readonly property bool commercialVpnActive: mullvadConnected || protonConnected
+}