diff --git a/hw/dixie/default.nix b/hw/dixie/default.nix
index 8915a6c..2d0c43e 100644
--- a/hw/dixie/default.nix
+++ b/hw/dixie/default.nix
@@ -326,9 +326,12 @@ in
       };
     };
 
-    # Reachable only over the tailnet: 11434 (router), 11433 (vision), 11435 (tether)
-    # on tailscale0, and SSH from the LAN (base config opens 22) for bring-up.
-    networking.firewall.interfaces.tailscale0.allowedTCPPorts = [ 11433 11434 11435 9835 ];
+    # Reachable only over the tailnet: 11434 (router), 11433 (vision), 11435
+    # (tether), 9835 (nvidia), 5432 (dropsonde Postgres) on tailscale0, and SSH
+    # from the LAN (base config opens 22) for bring-up.
+    networking.firewall.interfaces.tailscale0.allowedTCPPorts = [
+      11433 11434 11435 9835 5432
+    ];
 
     services.prometheus.exporters.nvidia-gpu = {
       enable = true;