diff --git a/k8s/network-policy.yaml b/k8s/network-policy.yaml
index 1c1ecdc..7544059 100644
--- a/k8s/network-policy.yaml
+++ b/k8s/network-policy.yaml
@@ -31,12 +31,14 @@ spec:
       port: 8080
   egress:
   # Allow Kubernetes API server (ServiceAdapter CRD loader)
+  # Cilium doesn't match ipBlock against ClusterIP VIPs, so we target
+  # the real control-plane endpoint IPs on port 6443.
   - to:
     - ipBlock:
-        cidr: 10.96.0.1/32
+        cidr: 192.168.1.0/24
     ports:
     - protocol: TCP
-      port: 443
+      port: 6443
   # Allow DNS
   - to:
     - namespaceSelector: