diff --git a/modules/build-types/pxe-boot.nix b/modules/build-types/pxe-boot.nix
index d3626d7..5006c7d 100644
--- a/modules/build-types/pxe-boot.nix
+++ b/modules/build-types/pxe-boot.nix
@@ -417,30 +417,28 @@ in
           ExecStart = stageSystemRescue;
         };
       };
-      dnsmasq = {
-        enable = true;
-        settings = {
-          # Proxy mode: respond only to PXE DHCP requests, leave normal leases to router
-          dhcp-range = [ "192.168.2.0,proxy" ];
-          # iPXE client detection
-          dhcp-match = [
-            "set:ipxe,175"
-            "set:efi64,option:client-arch,7"
-            "set:efi64,option:client-arch,9"
-          ];
-          dhcp-userclass = "set:ipxe,iPXE";
-          # Boot file selection
-          dhcp-boot = [
-            "tag:ipxe,tag:efi64,http://${vars.pxeServerIp}/boot.ipxe"
-            "tag:ipxe,http://${vars.pxeServerIp}/boot.ipxe"
-            "tag:efi64,ipxe.efi,,${vars.pxeServerIp}"
-            "undionly.kpxe,,${vars.pxeServerIp}"
-          ];
-        };
-      };
+    };
+  };
+
+  services.dnsmasq = {
+    enable = true;
+    settings = {
+      dhcp-range = [ "192.168.2.0,proxy" ];
+      dhcp-match = [
+        "set:ipxe,175"
+        "set:efi64,option:client-arch,7"
+        "set:efi64,option:client-arch,9"
+      ];
+      dhcp-userclass = "set:ipxe,iPXE";
+      dhcp-boot = [
+        "tag:ipxe,tag:efi64,http://${vars.pxeServerIp}/boot.ipxe"
+        "tag:ipxe,http://${vars.pxeServerIp}/boot.ipxe"
+        "tag:efi64,ipxe.efi,,${vars.pxeServerIp}"
+        "undionly.kpxe,,${vars.pxeServerIp}"
+      ];
     };
   };
 
   networking.firewall.allowedTCPPorts = [ vars.ports.pxeBootHttp ];
-  networking.firewall.allowedUDPPorts = [ vars.ports.pxeBootTftp ];
+  networking.firewall.allowedUDPPorts = [ vars.ports.pxeBootTftp 67 ];
 }