diff --git a/nixos/modules/services/networking/knot.nix b/nixos/modules/services/networking/knot.nix
index a9a6b2800d88..4cfdd9dab0b1 100644
--- a/nixos/modules/services/networking/knot.nix
+++ b/nixos/modules/services/networking/knot.nix
@@ -63,9 +63,12 @@ let
           "submission"
           "dnskey-sync"
           "policy"
+          "external"
+          # mod-* is above
           "template"
           "zone"
           "include"
+          "clear"
         ];
       secsCheck =
         let