diff --git a/modules/printing/default.nix b/modules/printing/default.nix
index b7ec266b..3a177336 100644
--- a/modules/printing/default.nix
+++ b/modules/printing/default.nix
@@ -35,6 +35,9 @@ in {
 
   networking.hosts = flake.self.lib.addLocalHostname ["cups.local"];
 
+  # Allow port 8612, used by sane-pixma(5) for scanner detection
+  networking.firewall.allowedTCPPorts = [ 8612 ];
+
   services.caddy = {
     enable = true;
     extraConfig = ''