diff --git a/pkgs/jellysearch/package.nix b/pkgs/jellysearch/package.nix
index 395da6c..9826c40 100644
--- a/pkgs/jellysearch/package.nix
+++ b/pkgs/jellysearch/package.nix
@@ -16,6 +16,10 @@ buildDotnetModule rec {
     hash = "sha256-7t0j4S5A9yvRN8zjToMNsxJ72OjU3j++EAqq9CKcPaI=";
   };
 
+  patches = [
+    ./patches/Only-listen-on-loopback-interface.patch
+  ];
+
   projectFile = "src/JellySearch/JellySearch.csproj";
   executables = [ "jellysearch" ];
   nugetDeps = ./nuget-deps.json;
diff --git a/pkgs/jellysearch/patches/Only-listen-on-loopback-interface.patch b/pkgs/jellysearch/patches/Only-listen-on-loopback-interface.patch
new file mode 100644
index 0000000..fea3b7e
--- /dev/null
+++ b/pkgs/jellysearch/patches/Only-listen-on-loopback-interface.patch
@@ -0,0 +1,24 @@
+From dede2b55ef53028b1347ccb731657a12d7fa3d15 Mon Sep 17 00:00:00 2001
+From: Jordan Holt <jordan@vimium.com>
+Date: Sun, 22 Jun 2025 17:16:56 +0100
+Subject: [PATCH] Only listen on loopback interface
+
+---
+ src/JellySearch/Program.cs | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/JellySearch/Program.cs b/src/JellySearch/Program.cs
+index a0c6ee1..98798f7 100644
+--- a/src/JellySearch/Program.cs
++++ b/src/JellySearch/Program.cs
+@@ -6,7 +6,7 @@ using Quartz.Impl;
+
+ var builder = WebApplication.CreateBuilder(args);
+
+-builder.WebHost.UseUrls("http://0.0.0.0:5000"); // Listen on every IP
++builder.WebHost.UseUrls("http://127.0.0.1:5000"); // Listen on loopback only
+
+ builder.Services.AddCors(options =>
+ {
+--
+2.49.0