diff --git a/m/weasel/hydra.nix b/m/weasel/hydra.nix
index 2a4eecb6..828a2009 100644
--- a/m/weasel/hydra.nix
+++ b/m/weasel/hydra.nix
@@ -10,4 +10,6 @@
     # you will probably also want, otherwise *everything* will be built from scratch
     useSubstitutes = true;
   };
+
+  networking.firewall.allowedTCPPorts = [ config.services.hydra.port ];
 }