diff --git a/hosts/baseline.nix b/hosts/baseline.nix
index 4c70936..1a59328 100644
--- a/hosts/baseline.nix
+++ b/hosts/baseline.nix
@@ -114,12 +114,6 @@
     };
   };
 
-  networking.firewall.allowedTCPPorts = [
-    9100 # prometheus node exporter
-    9427 # prometheus ping exporter
-    9558 # prometheus systemd exporter
-  ];
-
   security.sudo.extraRules = [
     {
       users = [ "greg" ];
diff --git a/modules/nixos/home.nix b/modules/nixos/home.nix
index 0e2d67f..dc69397 100644
--- a/modules/nixos/home.nix
+++ b/modules/nixos/home.nix
@@ -46,5 +46,14 @@ with lib;
     systemd.tmpfiles.rules = [
       "d /var/lib/attic-client 0755 root root -"
     ];
+
+    # Open Prometheus exporter ports on LAN-connected hosts only.
+    # NOT in baseline.nix to avoid exposing these on internet-facing hosts (e.g. linode).
+    networking.firewall.allowedTCPPorts = [
+      9100 # prometheus node exporter
+      9115 # prometheus blackbox exporter
+      9427 # prometheus ping exporter
+      9558 # prometheus systemd exporter
+    ];
   };
 }