diff --git a/modules/k3s/k3s.nix b/modules/k3s/k3s.nix
index bd25ee9..9f0b0e4 100644
--- a/modules/k3s/k3s.nix
+++ b/modules/k3s/k3s.nix
@@ -1,9 +1,26 @@
 {
-  networking.firewall.allowedTCPPorts = [ 6443 80 443 ];
+  networking.firewall.allowedTCPPorts = [ 6443 80 443 33073 ];
+  networking.firewall.allowedUDPPorts = [ 3479 ];
 
   services.k3s = {
     enable = true;
     role = "server";
     extraFlags = "--write-kubeconfig-mode 644";
   };
+
+  # k3s manifests live in a separate repo (git.archfox.org/poslop/k3s),
+  # cloned at /home/poslop/k3s. Bind-mounting (not symlinking!) into
+  # k3s's manifest dir lets k3s's native recursive directory watch pick
+  # up new/changed files automatically -- no nixos-rebuild, no kubectl
+  # apply needed for changes under apps/. Symlinked dirs are explicitly
+  # NOT picked up by k3s's watcher (see k3s-io/k3s#9288), hence bind mount.
+  #
+  # TODO: once Flux is set up, replace this bind mount with a Flux
+  # GitRepository/Kustomization pointing at the same repo, and remove
+  # this fileSystems entry.
+  fileSystems."/var/lib/rancher/k3s/server/manifests/apps" = {
+    device = "/home/poslop/k3s/apps";
+    fsType = "none";
+    options = [ "bind" "ro" ];
+  };
 }