diff --git a/hosts/nerd/nerd.nix b/hosts/nerd/nerd.nix
index dff3203..469e6f0 100644
--- a/hosts/nerd/nerd.nix
+++ b/hosts/nerd/nerd.nix
@@ -79,8 +79,16 @@
     enable = true;
     virtualHosts."nerd.bula22.de" = {
       extraConfig = ''
+        @disallow_export {
+          not remote_ip 10.42.10.0/24 2a01:4f8:1c0c:8221::/64
+          path /export.json*
+        }
+
         route {
           file_server /static/*
+          respond @disallow_export 403 {
+            close
+          }
           reverse_proxy * http://127.0.0.1:10510
         }