diff --git a/roles/forgejo-runner.nix b/roles/forgejo-runner.nix
index c165434..f2f2ffc 100644
--- a/roles/forgejo-runner.nix
+++ b/roles/forgejo-runner.nix
@@ -23,6 +23,8 @@
           cfg = config.forgejo-runner;
         in
         {
+          networking.firewall.allowedTCPPorts = [ 39175 ];
+
           sops.secrets = {
             "forgejo_runner/token" = {
               owner = "root";