diff --git a/modules/build-types/server.nix b/modules/build-types/server.nix
index c55291a..882a5b4 100644
--- a/modules/build-types/server.nix
+++ b/modules/build-types/server.nix
@@ -88,5 +88,9 @@ in
     '';
   };
 
-  networking.firewall.allowedTCPPorts = [ vars.ports.nfsRpcbind vars.ports.nfsd ];
+  # mountd (20048) is needed for showmount/NFSv3 mount protocol — without it
+  # clients can reach portmapper (111) and get the mountd port back, then
+  # time out trying to connect to it. All three ports need TCP and UDP.
+  networking.firewall.allowedTCPPorts = [ vars.ports.nfsRpcbind vars.ports.nfsd vars.ports.nfsMountd ];
+  networking.firewall.allowedUDPPorts = [ vars.ports.nfsRpcbind vars.ports.nfsd vars.ports.nfsMountd ];
 }
diff --git a/variables.nix b/variables.nix
index f6a34b5..9f27d49 100644
--- a/variables.nix
+++ b/variables.nix
@@ -137,10 +137,14 @@
     # (modules/build-types/pxe-boot.nix).
     pxeBootTftp = 69;
 
-    # `server`'s NFS exports need both the portmapper (rpcbind) and the
-    # NFS data port itself opened (modules/build-types/server.nix).
+    # `server`'s NFS exports: portmapper (rpcbind), NFS data, and the
+    # mountd RPC service (used by showmount/NFSv3 mount protocol).
+    # Mountd listens on a fixed port so the firewall can whitelist it
+    # explicitly rather than opening all of rpcbind's dynamic range.
+    # All three need both TCP and UDP (modules/build-types/server.nix).
     nfsRpcbind = 111;
     nfsd = 2049;
+    nfsMountd = 20048;
 
     # Opened on the docker host's firewall for the Traefik-fronted
     # container stack (docker-compose config lives in the separate