diff --git a/nixos/machines/chungus/paperless.nix b/nixos/machines/chungus/paperless.nix
index acda414..7907d3e 100644
--- a/nixos/machines/chungus/paperless.nix
+++ b/nixos/machines/chungus/paperless.nix
@@ -1,7 +1,11 @@
 { config, ... }: {
+
   services.paperless = {
     enable = true;
   };
+
+  networking.firewall.interfaces.wg0.allowedTCPPorts = [ config.services.paperless.port ];
+
   services.nginx.virtualHosts."paperless.${config.networking.hostName}.private" = {
     extraConfig = ''
       allow ${config.tinc.private.subnet};