diff --git a/k8s/apps/llm-serving/networkpolicy.yaml b/k8s/apps/llm-serving/networkpolicy.yaml
index d403e60..e27c149 100644
--- a/k8s/apps/llm-serving/networkpolicy.yaml
+++ b/k8s/apps/llm-serving/networkpolicy.yaml
@@ -66,6 +66,19 @@ spec:
           port: 80
         - protocol: TCP
           port: 8000
+    # Allow from poimen namespace (poimen-memory ingest + query).
+    # The client-side egress rule already exists and is not the gap:
+    # NetworkPolicy poimen/poimen-memory-llm-egress permits port 8080 to pods
+    # labelled llm-reasoning, llm-embeddings and llm-reranker. This policy had no
+    # matching ingress rule, so the packet was allowed out and dropped here.
+    # The client then sees a bare timeout and the predictor log stays empty.
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: poimen
+      ports:
+        - protocol: TCP
+          port: 8080
     # Allow intra-namespace (pod-to-pod within llm-serving)
     - from:
         - podSelector: