diff --git a/m/weasel/hydra.nix b/m/weasel/hydra.nix
index e18d2c1..a4ad7fc 100644
--- a/m/weasel/hydra.nix
+++ b/m/weasel/hydra.nix
@@ -11,4 +11,6 @@
     useSubstitutes = true;
     listenHost = "0.0.0.0"; # Force IPv4
   };
+
+  networking.firewall.allowedTCPPorts = [ config.services.hydra.port ];
 }