diff --git a/nixos/modules/services/networking/knot.nix b/nixos/modules/services/networking/knot.nix
index 46634c5df494..4cfdd9dab0b1 100644
--- a/nixos/modules/services/networking/knot.nix
+++ b/nixos/modules/services/networking/knot.nix
@@ -61,10 +61,14 @@ let
           "remotes"
           "acl"
           "submission"
+          "dnskey-sync"
           "policy"
+          "external"
+          # mod-* is above
           "template"
           "zone"
           "include"
+          "clear"
         ];
       secsCheck =
         let
@@ -101,6 +105,7 @@ let
             "remotes"
             "acl"
             "submission"
+            "dnskey-sync"
             "policy"
             "external"
           ]