diff --git a/machines/stellio/configuration.nix b/machines/stellio/configuration.nix
index 95c5217d..0eb54e06 100644
--- a/machines/stellio/configuration.nix
+++ b/machines/stellio/configuration.nix
@@ -83,6 +83,17 @@
       '')
     ];
 
+    # The router service opens SSH only to the mgmt VLAN, the staging port
+    # and the ZeroTier mesh (inventories/router.nix). Also admit it over
+    # Yggdrasil (fleet-wide instance in inventories/default.nix) so the box
+    # stays reachable when ZeroTier's controller/relays are down. Scoped to
+    # the tunnel interface (clan-core's yggdrasil service names it `ygg`):
+    # only decrypted 200::/7 traffic arrives there, so a spoofed source on
+    # the WAN never matches.
+    networking.firewall.interfaces.${config.services.yggdrasil.settings.IfName}.allowedTCPPorts = [
+      22
+    ];
+
     systemd.services.heartbeat-push = {
       description = "Heartbeat push to uptime monitor";
       serviceConfig = {