diff --git a/app/Console/Commands/FluxDev.php b/app/Console/Commands/FluxDev.php
index ed8c015c4..2451fac77 100644
--- a/app/Console/Commands/FluxDev.php
+++ b/app/Console/Commands/FluxDev.php
@@ -39,6 +39,10 @@ class FluxDev extends Command
             'containers.healthcheck.run',
             'ingress.apply',
             'ingress.stop',
+            'firewall.allow',
+            'firewall.revoke',
+            'firewall.list',
+            'firewall.reconcile',
         ];
     }
 
diff --git a/tests/Feature/FluxDevCommandTest.php b/tests/Feature/FluxDevCommandTest.php
index f3bdc98fd..1bc905fd6 100644
--- a/tests/Feature/FluxDevCommandTest.php
+++ b/tests/Feature/FluxDevCommandTest.php
@@ -44,6 +44,10 @@ it('mints a host jwt with primitive capabilities by default', function () {
 
     expect($claims->caps)->toContain('containers.list')
         ->and($claims->caps)->toContain('ingress.apply')
+        ->and($claims->caps)->toContain('firewall.allow')
+        ->and($claims->caps)->toContain('firewall.revoke')
+        ->and($claims->caps)->toContain('firewall.list')
+        ->and($claims->caps)->toContain('firewall.reconcile')
         ->and($claims->caps)->not->toContain('coold');
 });