diff --git a/peer/on_hub.go b/peer/on_hub.go
index be66b89..59ba67e 100644
--- a/peer/on_hub.go
+++ b/peer/on_hub.go
@@ -37,7 +37,14 @@ func (a *App) onAddPeer(p HubPeer) {
 	a.peersByIP[peer.VPNIP] = peer
 
 	if !peer.IsPublic {
-		a.devAddPeer(peer)
+		if a.isPublic {
+			// Public nodes accept traffic from non-public peers as soon as they
+			// initiate a handshake. Set /32 AllowedIPs now; WireGuard learns the
+			// endpoint from the incoming handshake automatically.
+			a.devPromote(peer)
+		} else {
+			a.devAddPeer(peer)
+		}
 		return
 	}
 
diff --git a/peer/on_tick.go b/peer/on_tick.go
index c258cb0..a9aedda 100644
--- a/peer/on_tick.go
+++ b/peer/on_tick.go
@@ -37,7 +37,9 @@ func (a *App) onTick() {
 
 		case StateDirect:
 			// Demote stale non-public direct peers back to probing.
-			if !p.IsPublic && !p.Up() {
+			// Public nodes skip this: the non-public peer will re-initiate the
+			// handshake, and WireGuard will update the endpoint automatically.
+			if !p.IsPublic && !p.Up() && !a.isPublic {
 				a.devAddProbe(p, p.WGEndpoint())
 			}
 		}