diff --git a/k8s/infra/forgejo-runner/templates/networkpolicy.yaml b/k8s/infra/forgejo-runner/templates/networkpolicy.yaml
index 890de0a..2998562 100644
--- a/k8s/infra/forgejo-runner/templates/networkpolicy.yaml
+++ b/k8s/infra/forgejo-runner/templates/networkpolicy.yaml
@@ -29,6 +29,16 @@ spec:
             except:
               - 192.168.1.0/24
               - 10.244.0.0/16
+    # Kubernetes API server — CI needs kubectl access to create
+    # Tekton PipelineRuns for integration testing.
+    # The API server runs on control-plane nodes (192.168.1.0/24);
+    # we allow port 6443 only to that subnet.
+    - to:
+        - ipBlock:
+            cidr: 192.168.1.0/24
+      ports:
+        - protocol: TCP
+          port: 6443
     # ingress-nginx, which is how forgejo.riotpiao.com resolves (CoreDNS
     # rewrites that name to ingress-nginx-controller.ingress-nginx.svc).
     # Image pushes go to that name so the tag matches what containerd pulls