diff --git a/ops/nixos/totoro/default.nix b/ops/nixos/totoro/default.nix
index d83346fcda..af16fb3571 100644
--- a/ops/nixos/totoro/default.nix
+++ b/ops/nixos/totoro/default.nix
@@ -79,6 +79,7 @@ in {
     };
     bridges.br-int.interfaces = [];
     firewall.allowedTCPPorts = [
+      80 443  # web
       4001  # ipfs
     ];
     firewall.allowedUDPPorts = [
@@ -106,8 +107,6 @@ in {
     members = ["pancake" "nginx"];
   };
 
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-
   systemd.tmpfiles.rules = [
     "L /var/lib/export - - - - /export"
   ];