diff --git a/modules/services/syncplay.nix b/modules/services/syncplay.nix
index 447e4a7..ca4551b 100644
--- a/modules/services/syncplay.nix
+++ b/modules/services/syncplay.nix
@@ -4,4 +4,5 @@
     enable = true;
     passwordFile = config.sops.secrets.syncplay.path;
   };
+  networking.firewall.allowedTCPPorts = [ 8999 ];
 }