diff --git a/CONTEXT.md b/CONTEXT.md
index 1570822..bc16a93 100644
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -88,8 +88,10 @@ printed enclosure, speakers. Work until those arrive is limited to what the Pi,
 
 ## Next
 
-1. Finish package 0b: nftables rewrite (accept 4713/8765 only on `usb0` from `10.55.0.1`), Wi-Fi-off
-   boot test, replug recovery, NixOS snippet in `host/nixos/`.
+1. Finish package 0b: Wi-Fi-off boot test, replug recovery, serial login check, NixOS snippet in
+   `host/nixos/`, and make the firewall load at boot. A new Omarchy host with a GPU (runs the local
+   model "ornith") arrives this week: it needs only `host/omarchy/robot-usb-link.sh` and its SSH key
+   added to the Pi.
 2. Audio (package 1; needs the `wm8960-soundcard` overlay and a reboot), camera (package 3), then
    the rest of the packages in `HANDOFF.md`.
 
diff --git a/pi/nftables-robot.nft b/pi/nftables-robot.nft
index a0abd95..c52aa84 100644
--- a/pi/nftables-robot.nft
+++ b/pi/nftables-robot.nft
@@ -1,6 +1,7 @@
 #!/usr/sbin/nft -f
-# Only your Omarchy machine may reach the robot's audio (4713) and MCP (8765) ports.
-# Everything else, SSH included, is left alone. __HOST_IP__ is filled in by install.sh.
+# The robot's audio (4713), MCP (8765) and face webhook (8766) ports are reachable only over the
+# USB link, and only from the host at 10.55.0.1. Every other interface, Wi-Fi included, is dropped.
+# SSH and everything else are left alone: that policy is the owner's call.
 
 table inet robot
 delete table inet robot
@@ -9,7 +10,7 @@ table inet robot {
     chain input {
         type filter hook input priority 0; policy accept;
         iif "lo" accept
-        ip  saddr __HOST_IP__ tcp dport { 4713, 8765 } accept
-        tcp dport { 4713, 8765 } drop
+        iifname "usb0" ip saddr 10.55.0.1 tcp dport { 4713, 8765, 8766 } accept
+        tcp dport { 4713, 8765, 8766 } drop
     }
 }