diff --git a/apps/rego-tunnel/build/start-vm.sh b/apps/rego-tunnel/build/start-vm.sh
index c3a87ec..295ae34 100755
--- a/apps/rego-tunnel/build/start-vm.sh
+++ b/apps/rego-tunnel/build/start-vm.sh
@@ -25,6 +25,10 @@ sleep 2
 
 TAP_NAME="${TAP_NAME:-tap0}"
 
+# Optional: provide a dedicated 9p export for host app-data (bind-mounted into the container at /shared/app-data)
+TSCLIENT_PATH="/shared/app-data"
+TSCLIENT_TAG="${TSCLIENT_TAG:-TSCLIENT}"
+
 exec qemu-system-x86_64 \
 	-enable-kvm \
 	-cpu host \
@@ -33,6 +37,8 @@ exec qemu-system-x86_64 \
 	-hda /vm/linux-vm.qcow2 \
 	-fsdev local,id=fsdev0,path=/shared,security_model=none,multidevs=remap \
 	-device virtio-9p-pci,fsdev=fsdev0,mount_tag=shared \
+	-fsdev local,id=fsdev1,path="$TSCLIENT_PATH",security_model=none,multidevs=remap \
+	-device virtio-9p-pci,fsdev=fsdev1,mount_tag="$TSCLIENT_TAG" \
 	-netdev tap,id=net0,ifname="$TAP_NAME",script=no,downscript=no \
 	-device virtio-net-pci,netdev=net0,mac=52:54:00:12:34:56 \
 	-vnc :0 \