diff --git a/modules/nixos/base/ssh.nix b/modules/nixos/base/ssh.nix
index 1409e303..e32ec737 100644
--- a/modules/nixos/base/ssh.nix
+++ b/modules/nixos/base/ssh.nix
@@ -1,7 +1,8 @@
 { lib, ... }:
 {
-  # Or disable the firewall altogether.
-  networking.firewall.enable = lib.mkDefault false;
+  # Secure by default: firewall ON everywhere unless a host explicitly disables it
+  # (servers disable it in modules/nixos/server/{server,server-aarch64}.nix).
+  networking.firewall.enable = lib.mkDefault true;
   # Enable the OpenSSH daemon.
   services.openssh = {
     enable = true;
diff --git a/modules/nixos/server/server-aarch64.nix b/modules/nixos/server/server-aarch64.nix
index d321cbc5..ce56dc4a 100644
--- a/modules/nixos/server/server-aarch64.nix
+++ b/modules/nixos/server/server-aarch64.nix
@@ -17,6 +17,10 @@
     ../../base
   ];
 
+  # Servers run on the trusted internal LAN (NAT'd; WAN protected at the router).
+  # Keep the firewall off here; the secure default is ON (see modules/nixos/base/ssh.nix).
+  networking.firewall.enable = false;
+
   # Fix: jasper is marked as broken, refusing to evaluate.
   environment.enableAllTerminfo = lib.mkForce false;
 }
diff --git a/modules/nixos/server/server.nix b/modules/nixos/server/server.nix
index f95f803a..3e95d887 100644
--- a/modules/nixos/server/server.nix
+++ b/modules/nixos/server/server.nix
@@ -4,4 +4,8 @@
     ../base
     ../../base
   ];
+
+  # Servers run on the trusted internal LAN (NAT'd; WAN protected at the router).
+  # Keep the firewall off here; the secure default is ON (see modules/nixos/base/ssh.nix).
+  networking.firewall.enable = false;
 }
diff --git a/outputs/aarch64-linux/tests/security-firewall/expected.nix b/outputs/aarch64-linux/tests/security-firewall/expected.nix
new file mode 100644
index 00000000..bf428c90
--- /dev/null
+++ b/outputs/aarch64-linux/tests/security-firewall/expected.nix
@@ -0,0 +1,7 @@
+{ outputs, ... }:
+let
+  inherit (outputs) nixosConfigurations;
+in
+builtins.mapAttrs (name: {
+  enabled = name == "ai-niri" || name == "shoukei-niri";
+}) nixosConfigurations
diff --git a/outputs/aarch64-linux/tests/security-firewall/expr.nix b/outputs/aarch64-linux/tests/security-firewall/expr.nix
new file mode 100644
index 00000000..8423c4e8
--- /dev/null
+++ b/outputs/aarch64-linux/tests/security-firewall/expr.nix
@@ -0,0 +1,7 @@
+{ outputs, ... }:
+let
+  inherit (outputs) nixosConfigurations;
+in
+builtins.mapAttrs (name: {
+  enabled = nixosConfigurations.${name}.config.networking.firewall.enable;
+}) nixosConfigurations
diff --git a/outputs/x86_64-linux/tests/security-firewall/expected.nix b/outputs/x86_64-linux/tests/security-firewall/expected.nix
new file mode 100644
index 00000000..bf428c90
--- /dev/null
+++ b/outputs/x86_64-linux/tests/security-firewall/expected.nix
@@ -0,0 +1,7 @@
+{ outputs, ... }:
+let
+  inherit (outputs) nixosConfigurations;
+in
+builtins.mapAttrs (name: {
+  enabled = name == "ai-niri" || name == "shoukei-niri";
+}) nixosConfigurations
diff --git a/outputs/x86_64-linux/tests/security-firewall/expr.nix b/outputs/x86_64-linux/tests/security-firewall/expr.nix
new file mode 100644
index 00000000..8423c4e8
--- /dev/null
+++ b/outputs/x86_64-linux/tests/security-firewall/expr.nix
@@ -0,0 +1,7 @@
+{ outputs, ... }:
+let
+  inherit (outputs) nixosConfigurations;
+in
+builtins.mapAttrs (name: {
+  enabled = nixosConfigurations.${name}.config.networking.firewall.enable;
+}) nixosConfigurations