diff --git a/k8s/infra/poimen/graphql-netpol.yaml b/k8s/infra/poimen/graphql-netpol.yaml
new file mode 100644
index 0000000..50eff71
--- /dev/null
+++ b/k8s/infra/poimen/graphql-netpol.yaml
@@ -0,0 +1,28 @@
+---
+# Keep the GraphQL server reachable only from the one service that proxies it.
+#
+# poimen-graphql is already off the internet: its Service is ClusterIP on 8090 and
+# no Ingress names it. What it lacked is in-cluster isolation — a ClusterIP answers
+# every pod in the cluster.
+#
+# The only caller is poimen-memory, whose /graphql route forwards the request body
+# to MEM_GQL_PORT (8090). No other workload references this service.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: poimen-graphql-ingress
+  namespace: poimen
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: poimen-graphql
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: poimen-memory
+      ports:
+        - protocol: TCP
+          port: 8090
diff --git a/k8s/infra/poimen/kustomization.yaml b/k8s/infra/poimen/kustomization.yaml
index 30945a6..0884f5a 100644
--- a/k8s/infra/poimen/kustomization.yaml
+++ b/k8s/infra/poimen/kustomization.yaml
@@ -8,6 +8,8 @@ resources:
   - memory-db.yaml
   # ClusterIP alone is not isolation: every pod in the cluster can reach it.
   - memory-db-netpol.yaml
+  # Only poimen-memory's /graphql proxy calls 8090.
+  - graphql-netpol.yaml
   - poimen-sandbox-namespace.yaml
   - poimen-sandbox-quota.yaml
   - pi-session-netpol.yaml