diff --git a/kele.el b/kele.el
index b84e143d..0eaaa315 100644
--- a/kele.el
+++ b/kele.el
@@ -2034,9 +2034,16 @@ NAMESPACE and CONTEXT are used to identify the resource type to query for."
                  (format "%s to port-forward to: " (kele--singular gvk))
                  (-cut kele--resources-complete <> <> <> :cands cands)))
 
-          ;; TODO: Completion on the resource's exposed ports
+          (resource (kele--get-resource gvk name :context context :namespace ns))
+
           ;; TODO: Error if the port is already in use
-          (port (number-to-string (read-number "Port: "))))
+          ;; TODO: Extend port completion to all appropriate resource types
+          (port (if (string-equal (oref resource kind) "services")
+                    (completing-read "Port: "
+                                     (-map (lambda (port-spec) (number-to-string (alist-get 'port port-spec)))
+                                           (kele--service-ports resource))
+                                     nil t)
+                  (number-to-string (read-number "Port: ")))))
      (list context ns gvk name port)))
   (let* ((proc-name (format "kele: port-forward (%s/%s, %s, %s, %s)" (oref gvk kind) name context namespace port))
          (proc (make-process
@@ -2082,6 +2089,23 @@ PORTS is used according to `completion-extra-properties'."
                      'face 'completions-annotations))))
           ports))
 
+(cl-defun kele--service-ports (obj &key (protocol nil))
+  "Get the exposed ports for service OBJ.
+
+If PROTOCOL is provided, filter for only ports of that protocol.
+
+OBJ is assumed to be a `kele--resource-container' containing a
+Service resource."
+  (let-alist (oref obj resource)
+    (let ((ports .spec.ports))
+      (if protocol
+          (-filter (lambda (port-spec)
+                     (equal
+                      (alist-get 'protocol port-spec)
+                      protocol))
+                   (append ports '()))
+        (append ports '())))))
+
 (defun kele--port-forwards-active-p ()
   "Return non-nil if there are any port-forwards active."
   (< 0 (length (mapcar 'car kele--active-port-forwards))))
diff --git a/tests/unit/test-kele.el b/tests/unit/test-kele.el
index 18efcc1e..9faace3c 100644
--- a/tests/unit/test-kele.el
+++ b/tests/unit/test-kele.el
@@ -720,4 +720,25 @@ metadata:
       (kele-list-kill)
       (expect 'vtable-revert-command :to-have-been-called))))
 
+(describe "`kele--service-ports'"
+  (it "retrieves the port specs"
+    (expect
+     (kele--service-ports
+      (kele--resource-container-create
+       :resource '((spec . ((ports . [((name . "foo")
+                                       (protocol . "TCP")
+                                       (port . 8081))]))))))
+     :to-equal
+     '(((name . "foo") (protocol . "TCP") (port . 8081)))))
+  (it "filters by protocol"
+    (expect
+     (kele--service-ports
+      (kele--resource-container-create
+       :resource '((spec . ((ports . [((name . "foo")
+                                       (protocol . "TCP")
+                                       (port . 8081))])))))
+      :protocol "UDP")
+     :to-equal
+     nil)))
+
  ;;; test-kele.el ends here