diff --git a/internal/cmd/firewall/describe.go b/internal/cmd/firewall/describe.go
index f39415fe..30c26e6f 100644
--- a/internal/cmd/firewall/describe.go
+++ b/internal/cmd/firewall/describe.go
@@ -1,7 +1,9 @@
 package firewall
 
 import (
+	"fmt"
 	"net"
+	"strings"
 
 	"github.com/dustin/go-humanize"
 	"github.com/spf13/cobra"
@@ -71,17 +73,32 @@ var DescribeCmd = base.DescribeCmd[*hcloud.Firewall]{
 		if len(firewall.AppliedTo) == 0 {
 			cmd.Print("  Not applied\n")
 		} else {
-			for _, resource := range firewall.AppliedTo {
-				cmd.Printf("  - Type:\t\t%s\n", resource.Type)
-				switch resource.Type {
-				case hcloud.FirewallResourceTypeServer:
-					cmd.Printf("    Server ID:\t\t%d\n", resource.Server.ID)
-					cmd.Printf("    Server Name:\t%s\n", s.Client().Server().ServerName(resource.Server.ID))
-				case hcloud.FirewallResourceTypeLabelSelector:
-					cmd.Printf("    Label Selector:\t%s\n", resource.LabelSelector.Selector)
-				}
-			}
+			cmd.Print(describeResources(s, firewall.AppliedTo))
 		}
 		return nil
 	},
 }
+
+func describeResources(s state.State, resources []hcloud.FirewallResource) string {
+	var sb strings.Builder
+
+	for _, resource := range resources {
+		sb.WriteString(fmt.Sprintf("  - Type:\t\t%s\n", resource.Type))
+
+		switch resource.Type {
+		case hcloud.FirewallResourceTypeServer:
+			sb.WriteString(fmt.Sprintf("    Server ID:\t\t%d\n", resource.Server.ID))
+			sb.WriteString(fmt.Sprintf("    Server Name:\t%s\n", s.Client().Server().ServerName(resource.Server.ID)))
+
+		case hcloud.FirewallResourceTypeLabelSelector:
+			sb.WriteString(fmt.Sprintf("    Label Selector:\t%s\n", resource.LabelSelector.Selector))
+			if len(resource.AppliedToResources) > 0 {
+				sb.WriteString(fmt.Sprintf("    Applied to resources:\n"))
+				substr := describeResources(s, resource.AppliedToResources)
+				sb.WriteString(util.PrefixLines(substr, "  "))
+			}
+		}
+	}
+
+	return sb.String()
+}
diff --git a/internal/cmd/firewall/describe_test.go b/internal/cmd/firewall/describe_test.go
index a00ee4ad..1a811fdd 100644
--- a/internal/cmd/firewall/describe_test.go
+++ b/internal/cmd/firewall/describe_test.go
@@ -43,6 +43,22 @@ func TestDescribe(t *testing.T) {
 					ID: 321,
 				},
 			},
+			{
+				Type: hcloud.FirewallResourceTypeLabelSelector,
+				LabelSelector: &hcloud.FirewallResourceLabelSelector{
+					Selector: "foobar",
+				},
+				AppliedToResources: []hcloud.FirewallResource{
+					{
+						Type:   hcloud.FirewallResourceTypeServer,
+						Server: &hcloud.FirewallResourceServer{ID: 123},
+					},
+					{
+						Type:   hcloud.FirewallResourceTypeServer,
+						Server: &hcloud.FirewallResourceServer{ID: 456},
+					},
+				},
+			},
 		},
 		Labels: map[string]string{
 			"key": "value",
@@ -53,6 +69,12 @@ func TestDescribe(t *testing.T) {
 	fx.Client.FirewallClient.EXPECT().
 		Get(gomock.Any(), "test").
 		Return(fw, nil, nil)
+	fx.Client.ServerClient.EXPECT().
+		ServerName(int64(123)).
+		Return("appliedServer1")
+	fx.Client.ServerClient.EXPECT().
+		ServerName(int64(456)).
+		Return("appliedServer2")
 	fx.Client.ServerClient.EXPECT().
 		ServerName(int64(321)).
 		Return("myServer")
@@ -74,6 +96,15 @@ Applied To:
   - Type:		server
     Server ID:		321
     Server Name:	myServer
+  - Type:		label_selector
+    Label Selector:	foobar
+    Applied to resources:
+    - Type:		server
+      Server ID:		123
+      Server Name:	appliedServer1
+    - Type:		server
+      Server ID:		456
+      Server Name:	appliedServer2
 `, util.Datetime(fw.Created), humanize.Time(fw.Created))
 
 	require.NoError(t, err)