diff --git a/site/profile/manifests/firewall.pp b/site/profile/manifests/firewall.pp
index 0064a2e0f..199f3ab1b 100644
--- a/site/profile/manifests/firewall.pp
+++ b/site/profile/manifests/firewall.pp
@@ -43,6 +43,10 @@
   }
 
   Package <| tag == firewall |> -> Firewall <||>
+  resources { 'firewall':
+    purge => true,
+  }
+
   class {['profile::firewall::pre', 'profile::firewall::post']: }
 
   firewall { '004 accept all from local network':