diff --git a/k8s/network-policy.yaml b/k8s/network-policy.yaml
index 7544059..3f013cd 100644
--- a/k8s/network-policy.yaml
+++ b/k8s/network-policy.yaml
@@ -31,8 +31,13 @@ spec:
       port: 8080
   egress:
   # Allow Kubernetes API server (ServiceAdapter CRD loader)
-  # Cilium doesn't match ipBlock against ClusterIP VIPs, so we target
-  # the real control-plane endpoint IPs on port 6443.
+  # ClusterIP VIP (10.96.0.1:443) + real control-plane endpoints (port 6443)
+  - to:
+    - ipBlock:
+        cidr: 10.96.0.1/32
+    ports:
+    - protocol: TCP
+      port: 443
   - to:
     - ipBlock:
         cidr: 192.168.1.0/24