diff --git a/salt/firewall/containers.map.jinja b/salt/firewall/containers.map.jinja
index 566f55a40..7efb9abab 100644
--- a/salt/firewall/containers.map.jinja
+++ b/salt/firewall/containers.map.jinja
@@ -27,6 +27,7 @@
      'so-elastic-fleet',
      'so-elastic-fleet-package-registry',
      'so-influxdb',
+     'so-kafka',
      'so-kibana',
      'so-kratos',
      'so-logstash',
diff --git a/salt/firewall/defaults.yaml b/salt/firewall/defaults.yaml
index bf3a003f3..e51bf5825 100644
--- a/salt/firewall/defaults.yaml
+++ b/salt/firewall/defaults.yaml
@@ -370,6 +370,7 @@ firewall:
                 - elastic_agent_update
                 - localrules
                 - sensoroni
+                - kafka
             fleet:
               portgroups:
                 - elasticsearch_rest
diff --git a/salt/kafka/enabled.sls b/salt/kafka/enabled.sls
index 723f2be9a..49a0a9bbd 100644
--- a/salt/kafka/enabled.sls
+++ b/salt/kafka/enabled.sls
@@ -43,6 +43,8 @@ so-kafka:
       - /opt/so/conf/ca/cacerts:/etc/pki/java/sos/cacerts
       - /nsm/kafka/data/:/nsm/kafka/data/:rw
       - /opt/so/conf/kafka/server.properties:/kafka/config/kraft/server.properties
+    - watch:
+      - file: kafka_kraft_server_properties
 
 delete_so-kafka_so-status.disabled:
   file.uncomment: