diff --git a/configs/default.nix b/configs/default.nix
index b38214c..871130c 100644
--- a/configs/default.nix
+++ b/configs/default.nix
@@ -79,6 +79,16 @@ in {
       hardware.pulseaudio = {
         enable = true;
         package = pkgs.pulseaudioFull; # for bluetooth sound output
+        # copy server:/run/pulse/.config/pulse/cookie to client:~/.config/pulse/cookie to authenticate a client machine
+        extraConfig = ''
+          load-module ${toString [
+            "module-tunnel-sink-new"
+            "server=zaatar.r"
+            "sink_name=zaatar"
+            "channels=2"
+            "rate=44100"
+          ]}
+        '';
       };
 
       users.users.me.extraGroups = [ "audio" ];
diff --git a/systems/zaatar/configuration.nix b/systems/zaatar/configuration.nix
index 30592ce..664d11e 100644
--- a/systems/zaatar/configuration.nix
+++ b/systems/zaatar/configuration.nix
@@ -15,6 +15,18 @@
     <niveum/configs/mail/fetcher.nix>
     {
       sound.enable = true;
+
+      hardware.pulseaudio = {
+        enable = true;
+        systemWide = true;
+        extraConfig = ''
+          load-module ${toString [
+            "module-native-protocol-tcp"
+            "auth-ip-acl=127.0.0.1;10.243.2.0/24;192.168.0.0/16"
+          ]}
+        '';
+      };
+      networking.firewall.allowedTCPPorts = [ 4713 ];
     }
     {
       environment.systemPackages =