diff --git a/group_vars/all/security.yaml b/group_vars/all/security.yaml
index 24624e0..726aac9 100644
--- a/group_vars/all/security.yaml
+++ b/group_vars/all/security.yaml
@@ -7,6 +7,9 @@ security_firewall_allowed_ports:
   - "443/udp"
   - "53/udp"
 
+# Optional per-host nftables additions appended verbatim to the rendered config
+security_nftables_custom_config: ""
+
 security_ssh_port: 2424
 security_fail2ban_enabled: true
 security_fail2ban_custom_configuration_template: "jail.local.j2"
diff --git a/roles/security/templates/nftables.conf.j2 b/roles/security/templates/nftables.conf.j2
index 618a139..211e47b 100644
--- a/roles/security/templates/nftables.conf.j2
+++ b/roles/security/templates/nftables.conf.j2
@@ -32,3 +32,7 @@ table inet filter {
         policy accept;
     }
 }
+
+{% if security_nftables_custom_config is defined and security_nftables_custom_config | trim %}
+{{ security_nftables_custom_config | trim }}
+{% endif %}