diff --git a/k8s/deployment.yaml b/k8s/deployment.yaml
index 761c8de..e32b512 100644
--- a/k8s/deployment.yaml
+++ b/k8s/deployment.yaml
@@ -21,6 +21,10 @@ spec:
       labels:
         app: api-gateway
         component: gateway
+        # Required by the llm-serving-default-deny NetworkPolicy, which admits
+        # only pods labelled llm-client=true (from any namespace) on port 8080.
+        # Without it every upstream dial times out and dispatch returns 502.
+        llm-client: "true"
       annotations:
         prometheus.io/scrape: "true"
         prometheus.io/port: "8080"