diff --git a/modules/nixos/networking.nix b/modules/nixos/networking.nix
index 9902354..27c7eee 100644
--- a/modules/nixos/networking.nix
+++ b/modules/nixos/networking.nix
@@ -5,7 +5,7 @@
     networking.nftables.enable = true;
 
     services.openssh = {
-      openFirewall = false;
+      openFirewall = lib.mkDefault false;
       settings = {
         PermitRootLogin = "no";
         PasswordAuthentication = false;
diff --git a/modules/services/forgejo.nix b/modules/services/forgejo.nix
index 657f6b3..3308228 100644
--- a/modules/services/forgejo.nix
+++ b/modules/services/forgejo.nix
@@ -76,10 +76,8 @@ in
         ];
 
         boot.kernel.sysctl."net.ipv4.ip_unprivileged_port_start" = 22;
-        networking.firewall.allowedTCPPorts = [
-          22
-          80
-        ];
+        services.openssh.openFirewall = true;
+        networking.firewall.allowedTCPPorts = [ 80 ];
         services.openssh.ports = [ 2222 ];
 
         services.forgejo = {
diff --git a/modules/services/tangled.nix b/modules/services/tangled.nix
index 9b94b50..c993d75 100644
--- a/modules/services/tangled.nix
+++ b/modules/services/tangled.nix
@@ -9,7 +9,7 @@ in
     { pkgs, ... }:
     {
       local.caddy.reverseProxies.${external} = "${internal}:5555";
-      networking.firewall.allowedTCPPorts = [ 22 ];
+      services.openssh.openFirewall = true;
       systemd.services.knot-ssh = {
         wantedBy = [ "multi-user.target" ];
         serviceConfig = {