diff --git a/nixos/modules/services/monitoring/prometheus/exporters/rtl_433.nix b/nixos/modules/services/monitoring/prometheus/exporters/rtl_433.nix
index 01e420db3897..ef829a1b7d02 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/rtl_433.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/rtl_433.nix
@@ -61,6 +61,11 @@ in
     serviceConfig = {
       # rtl-sdr udev rules make supported USB devices +rw by plugdev.
       SupplementaryGroups = "plugdev";
+      # rtl_433 needs rw access to the USB radio.
+      PrivateDevices = lib.mkForce false;
+      DeviceAllow = lib.mkForce "char-usb_device rw";
+      RestrictAddressFamilies = [ "AF_NETLINK" ];
+
       ExecStart = let
         matchers = (map (m:
           "--channel_matcher '${m.name},${toString m.channel},${m.location}'"