diff --git a/dsl.nix b/dsl.nix
index 4745527..c07f613 100644
--- a/dsl.nix
+++ b/dsl.nix
@@ -295,6 +295,7 @@ rec {
         + lib.optionalString useIdmap ":idmap"
       ) allBindMounts;
       bindMountHostPaths = map (bm: bm.hostPath) (lib.attrValues allBindMounts);
+      deviceFlags = map (d: "--bind=${d}") devices;
       inherit (deriveIdentity ifPrefix.nspawn name)
         iface
         mac
@@ -381,7 +382,7 @@ rec {
       nixosContainer = {
         inherit autoStart privateUsers;
         bindMounts = { };
-        extraFlags = bindMountExtraFlags;
+        extraFlags = bindMountExtraFlags ++ deviceFlags;
         privateNetwork = true;
         extraVeths = linkVeths;
         config =
diff --git a/tests/server-n0/integration.py b/tests/server-n0/integration.py
index b5f95c8..8920514 100644
--- a/tests/server-n0/integration.py
+++ b/tests/server-n0/integration.py
@@ -333,6 +333,7 @@ with subtest("(functional): published ports follow the container's lifetime"):
 with subtest("(functional): declared devices are usable in-container"):
     for name, devices in DEVICES.items():
         for dev in devices:
+            # opened, not stat'd: without DeviceAllow= the node is still visible
             server.succeed(ct_cmd(name, f"exec 3<> {dev}"))