diff --git a/hosts/nixos/lapetus/services/syncthing.nix b/hosts/nixos/lapetus/services/syncthing.nix
index f07f1fa..3a9303e 100644
--- a/hosts/nixos/lapetus/services/syncthing.nix
+++ b/hosts/nixos/lapetus/services/syncthing.nix
@@ -1,6 +1,8 @@
 {
   imports = [ ../../common/optional/syncthing.nix ];
 
+  networking.firewall.allowedTCPPorts = [ 8384 ];
+
   services.syncthing = {
     devices.lapetus.id = "";
     guiAddress = "0.0.0.0:8384"; # TODO: put this behind nginx