diff --git a/nixos/modules/security/polkit.nix b/nixos/modules/security/polkit.nix
index d4a99ba8a7b6..c2bbe706529f 100644
--- a/nixos/modules/security/polkit.nix
+++ b/nixos/modules/security/polkit.nix
@@ -100,6 +100,12 @@ in
         # ~/.config/Yubico/u2f_keys (the default key file location)
         ProtectHome = "read-only";
       })
+      (lib.mkIf config.security.pam.zfs.enable {
+        PrivateDevices = false;
+        DeviceAllow = [
+          "/dev/zfs rw"
+        ];
+      })
     ];
 
     # The polkit daemon reads action/rule files