diff --git a/flake.nix b/flake.nix
index 48ffc57..e005317 100644
--- a/flake.nix
+++ b/flake.nix
@@ -62,7 +62,6 @@
         music_dir = "/${zpool_ssds}/music";
         torrent_group = "media";
 
-        # TODO: add checks to make sure none of these collide
         ports = {
           https = 443;
           jellyfin = 8096; # no services.jellyfin option for this
@@ -170,6 +169,26 @@
         };
         modules =
           [
+            # SAFETY! make sure no ports collide
+            (
+              { lib, ... }:
+              {
+                config = {
+                  assertions = [
+                    {
+                      assertion =
+                        let
+                          ports = lib.attrValues service_configs.ports;
+                          uniquePorts = lib.unique ports;
+                        in
+                        (lib.length ports) == (lib.length uniquePorts);
+                      message = "Duplicate ports detected in 'ports' configuration";
+                    }
+                  ];
+                };
+              }
+            )
+
             ./disk-config.nix
             disko.nixosModules.disko
             ./configuration.nix