diff --git a/nixos/modules/services/misc/taskserver/default.nix b/nixos/modules/services/misc/taskserver/default.nix
index 520a9c2ee1e5..8054dbe9f662 100644
--- a/nixos/modules/services/misc/taskserver/default.nix
+++ b/nixos/modules/services/misc/taskserver/default.nix
@@ -324,8 +324,13 @@ in {
       listenHost = mkOption {
         type = types.str;
         default = "localhost";
+        example = "::";
         description = ''
           The address (IPv4, IPv6 or DNS) to listen on.
+
+          If the value is something else than <literal>localhost</literal> the
+          port defined by <option>listenPort</option> is automatically added to
+          <option>networking.firewall.allowedTCPPorts</option>.
         '';
       };
 
@@ -519,6 +524,9 @@ in {
         '';
       };
     })
+    (mkIf (cfg.listenHost != "localhost") {
+      networking.firewall.allowedTCPPorts = [ cfg.listenPort ];
+    })
     { meta.doc = ./taskserver.xml; }
   ];
 }
diff --git a/nixos/tests/taskserver.nix b/nixos/tests/taskserver.nix
index 79a7703f037e..0521f97431b3 100644
--- a/nixos/tests/taskserver.nix
+++ b/nixos/tests/taskserver.nix
@@ -3,7 +3,6 @@ import ./make-test.nix {
 
   nodes = rec {
     server = {
-      networking.firewall.enable = false;
       services.taskserver.enable = true;
       services.taskserver.listenHost = "::";
       services.taskserver.fqdn = "server";
@@ -14,7 +13,6 @@ import ./make-test.nix {
     };
 
     client1 = { pkgs, ... }: {
-      networking.firewall.enable = false;
       environment.systemPackages = [ pkgs.taskwarrior pkgs.gnutls ];
       users.users.alice.isNormalUser = true;
       users.users.bob.isNormalUser = true;