diff --git a/modules/services/home-automation/default.nix b/modules/services/home-automation/default.nix
index 86a0067..78c3b10 100644
--- a/modules/services/home-automation/default.nix
+++ b/modules/services/home-automation/default.nix
@@ -110,6 +110,7 @@ in
         extraComponents = [
           "backup"
           "esphome"
+          "shelly"
           "prometheus"
         ] ++ cfg.extraComponents;
       };
@@ -132,6 +133,14 @@ in
       esphome.enable = true;
     };
 
+    # TODO remove after merge + backport: https://github.com/NixOS/nixpkgs/pull/270519
+    systemd.services.esphome.serviceConfig = {
+      ProtectHostname = lib.mkForce false;
+      ProtectKernelLogs = lib.mkForce false;
+      ProtectKernelTunables = lib.mkForce false;
+      ProcSubset = lib.mkForce "all";
+    };
+
     my.services.prometheus.rules = {
       homeassistant = {
         condition = ''homeassistant_entity_available{domain="persistent_notification", entity!~"persistent_notification.http_login|persistent_notification.recorder_database_migration"} >= 0'';