diff --git a/nixos/modules/issuer.nix b/nixos/modules/issuer.nix
index 5cec1c4a9dc07f297abab049790dbf970388c91b..da3eed73e59349b4faaf64ebb32c067e952917ae 100644
--- a/nixos/modules/issuer.nix
+++ b/nixos/modules/issuer.nix
@@ -189,7 +189,7 @@ in {
       extraGroups = [ "keys" ];
     };
 
-    # Open 80 and 443 for the certbot HTTP server and the PaymentServer HTTPS server.
+    # Open 80 and 443 for nginx
     networking.firewall.allowedTCPPorts = [
       80
       443
diff --git a/nixos/modules/spending.nix b/nixos/modules/spending.nix
index c6340af16b50c18c2eaaaaa6fcc1a5a08bea87f4..325dd147012b7844a8cb0b4b7071c4cd2cd88f28 100644
--- a/nixos/modules/spending.nix
+++ b/nixos/modules/spending.nix
@@ -145,5 +145,11 @@ in
           };
         };
       };
+
+      # Open 80 and 443 for nginx
+      networking.firewall.allowedTCPPorts = [
+        80
+        443
+      ];
     };
 }
diff --git a/nixos/tests/spending.nix b/nixos/tests/spending.nix
index ef88b682d3945117494d77655d1d27b0340acd7f..8500471a58ff3f447e03ec1bf9005ff626169113 100644
--- a/nixos/tests/spending.nix
+++ b/nixos/tests/spending.nix
@@ -11,10 +11,14 @@
       services.private-storage-spending.enable = true;
       services.private-storage-spending.domain = "localhost";
     };
+    external = { ... }: {
+      # A node that has no particular configuration, for testing access rules
+      # for external hosts.
+    };
   };
   testScript = { nodes }: let
     revision = nodes.spending.config.passthru.ourpkgs.zkap-spending-service.meta.rev;
-    curl = "${pkgs.curl}/bin/curl -sSf";
+    curl = "${pkgs.curl}/bin/curl -sSf --max-time 5";
   in
     ''
       import json
@@ -25,6 +29,9 @@
       with subtest("Ensure we can ping the spending service"):
         output = spending.succeed("${curl} http://localhost/v1/_ping")
         assert json.loads(output)["status"] == "ok", "Could not ping spending service."
+      with subtest("Ensure external hosts can ping the spending service"):
+        output = external.succeed("${curl} http://spending/v1/_ping")
+        assert json.loads(output)["status"] == "ok", "Could not ping spending service."
       with subtest("Ensure that the spending service version matches the expected version"):
         output = spending.succeed("${curl} http://localhost/v1/_version")
         assert json.loads(output)["revision"] == "${revision}", "Spending service revision does not match."
@@ -32,5 +39,7 @@
         # TODO: We should pass "-H 'accept: application/openmetrics-text'" here.
         # See https://github.com/prometheus/prometheus/issues/8932
         output = spending.succeed("${curl} http://localhost/metrics | ${pkgs.prometheus}/bin/promtool check metrics")
+      with subtest("Ensure that the metrics are not accesible from other machines"):
+        output = external.fail("${curl} http://spending/metrics")
     '';
 }