diff --git a/k8s/configmap.yaml b/k8s/configmap.yaml
index 0714348..14b9617 100644
--- a/k8s/configmap.yaml
+++ b/k8s/configmap.yaml
@@ -113,7 +113,7 @@ data:
 
     - serviceName: s3
       upstream:
-        url: http://minio.storage.svc.cluster.local:9000
+        url: http://minio.storage.svc.cluster.local:80
         timeoutSeconds: 30
       auth:
         required: false
diff --git a/k8s/gateway-config-secret.enc.yaml b/k8s/gateway-config-secret.enc.yaml
index 96f657f..fa55e3a 100644
--- a/k8s/gateway-config-secret.enc.yaml
+++ b/k8s/gateway-config-secret.enc.yaml
@@ -91,7 +91,7 @@ stringData:
           upstreamPath: /memory/skills
     - serviceName: s3
       upstream:
-        url: http://minio.storage.svc.cluster.local:9000
+        url: http://minio.storage.svc.cluster.local:80
         timeoutSeconds: 30
       auth:
         required: false
diff --git a/k8s/network-policy.yaml b/k8s/network-policy.yaml
index e0323aa..44364db 100644
--- a/k8s/network-policy.yaml
+++ b/k8s/network-policy.yaml
@@ -123,10 +123,14 @@ spec:
     - protocol: TCP
       port: 8080
   # Allow to MinIO (S3-compatible storage)
+  # Service `minio` listens on port 80 (targetPort 9000).
+  # Headless `minio-cluster-hl` is 9000. Allow both.
   - to:
     - namespaceSelector:
         matchLabels:
           kubernetes.io/metadata.name: storage
     ports:
+    - protocol: TCP
+      port: 80
     - protocol: TCP
       port: 9000