diff --git a/nixos/modules/monitoring/server/loki.nix b/nixos/modules/monitoring/server/loki.nix
index 6d98a1a9339a8ea8f225427842f64f5487a2cb20..491d1a4c5edd1100ea17c26bbe8e8799b9424582 100644
--- a/nixos/modules/monitoring/server/loki.nix
+++ b/nixos/modules/monitoring/server/loki.nix
@@ -8,7 +8,7 @@
 #
 
 {
-  config.networking.firewall.interfaces.monitoringvpn.allowedTCPPorts = [ 3100 9095 ];
+  config.networking.firewall.interfaces.monitoringvpn.allowedTCPPorts = [ 3100 ];
 
   config.services.loki = {
     enable = true;
@@ -19,7 +19,8 @@
 
         server = {
           http_listen_port = 3100;
-          grpc_listen_port = 9095;
+          grpc_listen_port = 9095; # unused, but no option to turn it off.
+          grpc_listen_address = "127.0.0.1"; # unused, but no option to turn it off.
         };
 
         ingester = {