diff --git a/modules/services/monitoring.nix b/modules/services/monitoring.nix
index 2037e08..848e838 100644
--- a/modules/services/monitoring.nix
+++ b/modules/services/monitoring.nix
@@ -23,4 +23,11 @@
       ];
     };
   };
+  networking.firewall = {
+    allowedTCPPorts = [
+      9001
+      22
+      9123 # always also allow ssh :screaming:
+    ];
+  };
 }