diff --git a/machines/mibook/configuration.nix b/machines/mibook/configuration.nix
index 3ac1514..e326ff7 100644
--- a/machines/mibook/configuration.nix
+++ b/machines/mibook/configuration.nix
@@ -10,6 +10,7 @@
     ./disks.nix
     ./hardware-configuration.nix
     ./environments.nix
+    ./network.nix
     # ./system.nix use docker here
   ];
 
diff --git a/machines/mibook/network.nix b/machines/mibook/network.nix
new file mode 100644
index 0000000..717010c
--- /dev/null
+++ b/machines/mibook/network.nix
@@ -0,0 +1,8 @@
+_: {
+  # Athena (local AI): allow LAN access to the Hermes web dashboard.
+  # Bound to 0.0.0.0:9119 in the athena docker stack; NixOS default-deny
+  # firewall otherwise blocks inbound connections from other devices.
+  networking.firewall.allowedTCPPorts = [
+    9119 # athena hermes dashboard
+  ];
+}