diff --git a/nixos/configuration-beacon-wsl.nix b/nixos/configuration-beacon-wsl.nix
index 71b522d..388005c 100644
--- a/nixos/configuration-beacon-wsl.nix
+++ b/nixos/configuration-beacon-wsl.nix
@@ -33,6 +33,7 @@
   security.sudo.wheelNeedsPassword = false;
 
   networking.hostName = "beacon";
+  networking.firewall.allowedTCPPorts = [ 22 ];
   time.timeZone = "Asia/Jerusalem";
 
   # GPU is exposed through WSL2 paravirtualization; no Linux NVIDIA KM needed