diff --git a/hosts/dust/default.nix b/hosts/dust/default.nix
index 4694752..b304861 100644
--- a/hosts/dust/default.nix
+++ b/hosts/dust/default.nix
@@ -225,10 +225,11 @@
     };
 
     experimental = {
-      clash_api = {
+      clash_api = rec {
         external_controller = "127.0.0.1:9090";
         external_ui = pkgs.metacubexd;
         secret = "hunter2";
+        access_control_allow_origin = [ "http://${external_controller}" ];
       };
     };
   };
diff --git a/overlays/default.nix b/overlays/default.nix
index ad2967b..c9fceb6 100644
--- a/overlays/default.nix
+++ b/overlays/default.nix
@@ -22,6 +22,20 @@ _final: prev: {
     '';
   };
 
+  # https://www.v2ex.com/t/1076579
+  sing-box = prev.sing-box.overrideAttrs (rec {
+    version = "1.10.0-beta.11";
+
+    src = prev.fetchFromGitHub {
+      owner = "SagerNet";
+      repo = "sing-box";
+      rev = "v${version}";
+      hash = "sha256-hxOQdrNQB/3KbI1ULDLPfMzFB1JmZb49iPEOtGzWajY=";
+    };
+
+    vendorHash = "sha256-rsgrcVkIMUIobuGFBlDDQM05sljZXShsa1+10xxzmlA=";
+  });
+
   qt6Packages = prev.qt6Packages.overrideScope (
     _final': prev': {
       # HACK: no more qt5