diff --git a/nix/modules/paperless/default.nix b/nix/modules/paperless/default.nix
index bfb6414..162ffd5 100644
--- a/nix/modules/paperless/default.nix
+++ b/nix/modules/paperless/default.nix
@@ -29,4 +29,6 @@ let nasDir = "/mnt/nas/HEY/_Nora/paperless"; in {
       reverse_proxy * localhost:${builtins.toString config.services.paperless.port}
     '';
   };
+
+  networking.firewall.allowedTCPPorts = [ config.services.paperless.port ];
 }