diff --git a/lib/genK3sAgentModule.nix b/lib/genK3sAgentModule.nix
index acd7703f..42249b5a 100644
--- a/lib/genK3sAgentModule.nix
+++ b/lib/genK3sAgentModule.nix
@@ -20,8 +20,8 @@ in
 
   # Deny pods the credential-bearing host ports before the pod accept below.
   networking.firewall.extraInputRules = pkgs.lib.mkAfter ''
-    ip  saddr 10.0.0.0/8 tcp dport { 22, 2049, 2283, 5432, 5900, 5901, 5902, 5903, 8000, 8081, 8082, 9090, 9093, 9100, 9633, 9835 } drop
-    ip6 saddr fd00::/104 tcp dport { 22, 2049, 2283, 5432, 5900, 5901, 5902, 5903, 8000, 8081, 8082, 9090, 9093, 9100, 9633, 9835 } drop
+    ip  saddr 10.0.0.0/8 tcp dport { 22, 2049, 2283, 2379, 5432, 5900, 5901, 5902, 5903, 8000, 8081, 8082, 9090, 9093, 9100, 9633, 9835 } drop
+    ip6 saddr fd00::/104 tcp dport { 22, 2049, 2283, 2379, 5432, 5900, 5901, 5902, 5903, 8000, 8081, 8082, 9090, 9093, 9100, 9633, 9835 } drop
     ip  saddr 10.0.0.0/8 accept
     ip6 saddr fd00::/104 accept
   '';
diff --git a/lib/genK3sServerModule.nix b/lib/genK3sServerModule.nix
index 821e6dc4..a5fe5ca8 100644
--- a/lib/genK3sServerModule.nix
+++ b/lib/genK3sServerModule.nix
@@ -47,8 +47,8 @@ in
 
   # Deny pods the credential-bearing host ports before the pod accept below.
   networking.firewall.extraInputRules = lib.mkAfter ''
-    ip  saddr 10.0.0.0/8 tcp dport { 22, 2049, 2283, 5432, 5900, 5901, 5902, 5903, 8000, 8081, 8082, 9090, 9093, 9100, 9633, 9835 } drop
-    ip6 saddr fd00::/104 tcp dport { 22, 2049, 2283, 5432, 5900, 5901, 5902, 5903, 8000, 8081, 8082, 9090, 9093, 9100, 9633, 9835 } drop
+    ip  saddr 10.0.0.0/8 tcp dport { 22, 2049, 2283, 2379, 5432, 5900, 5901, 5902, 5903, 8000, 8081, 8082, 9090, 9093, 9100, 9633, 9835 } drop
+    ip6 saddr fd00::/104 tcp dport { 22, 2049, 2283, 2379, 5432, 5900, 5901, 5902, 5903, 8000, 8081, 8082, 9090, 9093, 9100, 9633, 9835 } drop
     ip  saddr 10.0.0.0/8 accept
     ip6 saddr fd00::/104 accept
   '';
diff --git a/outputs/x86_64-linux/tests/security-k3s-pod-firewall/expr.nix b/outputs/x86_64-linux/tests/security-k3s-pod-firewall/expr.nix
index df2ab437..77665d2d 100644
--- a/outputs/x86_64-linux/tests/security-k3s-pod-firewall/expr.nix
+++ b/outputs/x86_64-linux/tests/security-k3s-pod-firewall/expr.nix
@@ -28,6 +28,7 @@ lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
     && acceptAt != null
     && dropAt < acceptAt
     && lib.hasInfix "2049" rules
+    && lib.hasInfix "2379" rules
     && lib.hasInfix "5432" rules
     && lib.hasInfix "5902" rules
 )