diff --git a/hosts/xlab-gateway/default.nix b/hosts/xlab-gateway/default.nix
index eb279af..eef4344 100644
--- a/hosts/xlab-gateway/default.nix
+++ b/hosts/xlab-gateway/default.nix
@@ -24,9 +24,30 @@
     kernel.sysctl = {
       "net.ipv4.ip_forward" = 1;
       "net.ipv6.conf.all.forwarding" = 1;
+
+      # BBR + fq: better throughput for xlab-ORIGINATED TCP over the high-RTT
+      # abroad WG paths (forwarded transit keeps the endpoints' own CC).
+      "net.core.default_qdisc" = "fq";
+      "net.ipv4.tcp_congestion_control" = "bbr";
+
+      # Bigger socket buffers / autotune ceiling for high-BDP abroad links.
+      "net.core.rmem_max" = 67108864;
+      "net.core.wmem_max" = 67108864;
+      "net.core.rmem_default" = 1048576;
+      "net.core.wmem_default" = 1048576;
+      "net.ipv4.tcp_rmem" = "4096 1048576 67108864";
+      "net.ipv4.tcp_wmem" = "4096 1048576 67108864";
+      "net.core.netdev_max_backlog" = 16384;
     };
+    # tcp_bbr is a module on this kernel (reno cubic only built-in) — load it
+    # so tcp_congestion_control = bbr above takes effect.
+    kernelModules = [ "tcp_bbr" ];
   };
 
+  # WireGuard-crypto + routing appliance: keep cores pinned so WG throughput
+  # doesn't sag while frequencies ramp on a burst, and to cut forwarding jitter.
+  powerManagement.cpuFreqGovernor = "performance";
+
   # Gateway doesn't need to block boot waiting for all interfaces
   systemd.network.wait-online.enable = false;