How do you deal with CrowdSec self-bans when you're behind CGNAT?

Hey guys, I'm running a public VPS reverse proxy (NPM + CrowdSec) that tunnels back to my home lab. My ISP uses CGNAT, so my home IP is always changing. Recently, a background sync on my local machine freaked out over some broken endpoints, triggered a CrowdSec brute-force rule, and banned my entire home network. Since my IP is dynamic, a static whitelist won't work, and whitelisting the ISP's whole subnet is obviously a bad idea. I was thinking about a DDNS workaround: Home server pushes IP changes to a DDNS domain. VPS runs a cron job every 5 mins to check the DDNS. If the IP is new, update the CrowdSec allowlist and clear any bans. The catch is the race condition. If my IP rotates and a local app immediately triggers a ban, I'm locked out until that 5-minute cron job wakes up to rescue me. For anyone else dealing with CGNAT and CrowdSec: Have you found a clean way to whitelist dynamic client IPs? Did you just give up on public endpoints and move everything behind Tailscale/Twingate? Or do you just tweak the CrowdSec scenarios to be less aggressive with false positives? Would love to hear your setups!