diff --git a/modules/firewall/default.nix b/modules/firewall/default.nix
index 4936eea..bddb484 100644
--- a/modules/firewall/default.nix
+++ b/modules/firewall/default.nix
@@ -53,6 +53,9 @@ let
   };
 in
 {
+  # we use the secrets subscriber to restart when interfaces change
+  imports = [ ../secrets ];
+
   options = {
     system.service.firewall = mkOption {
       type = liminix.lib.types.serviceDefn;