diff --git a/services/telegraf.nix b/services/telegraf.nix
index 4d35a188..8539ad66 100644
--- a/services/telegraf.nix
+++ b/services/telegraf.nix
@@ -14,6 +14,7 @@
 
   # Allow the telegraf account to invoke sudo without a password
   security.sudo.extraConfig = ''
+    Cmnd_Alias FAIL2BAN = /run/current-system/sw/bin/fail2ban-client status, /run/current-system/sw/bin/fail2ban-client status *
     telegraf ALL=(root) NOEXEC: NOPASSWD: FAIL2BAN
     Defaults!FAIL2BAN !logfile, !syslog, !pam_session
   '';