diff --git a/services/hydra/default.nix b/services/hydra/default.nix
index 1e54281..9240d76 100644
--- a/services/hydra/default.nix
+++ b/services/hydra/default.nix
@@ -64,6 +64,15 @@ in {
     # Can be removed once this is added to some common config template.
     nix.settings.trusted-users = [ "root" "hydra" "hydra-www" "@wheel" ];
 
+    # Because Hydra can't fetch flake inputs otherwise... also yes, this
+    # prefix-based matching is absurdly bad.
+    nix.settings.allowed-uris = [
+      "github:"
+      "https://github.com/"
+      "https://git.lix.systems/"
+      "https://git@git.lix.systems/"
+    ];
+
     services.hydra-dev = {
       enable = true;