diff --git a/deploy_tee/pulumi/seismic_node/__main__.py b/deploy_tee/pulumi/seismic_node/__main__.py
index 1e19d50..b8cd655 100644
--- a/deploy_tee/pulumi/seismic_node/__main__.py
+++ b/deploy_tee/pulumi/seismic_node/__main__.py
@@ -70,6 +70,11 @@ def _require_str(value: str | None) -> str:
     (9090, "prometheus"),
     (8545, "reth-rpc"),
     (8546, "reth-ws"),
+    # Summit consensus P2P (commonware-p2p, TCP). Left open like
+    # the other service ports — commonware authenticates peers by pubkey (only
+    # the validator set completes the handshake), so admission is app-layer, and
+    # a static IP allowlist would break validators that join dynamically later.
+    (18551, "summit-consensus"),
 ]
 
 # --------------------------------------------------------------------