diff --git a/k8s/network-policy.yaml b/k8s/network-policy.yaml
index 8ce0f12..e0323aa 100644
--- a/k8s/network-policy.yaml
+++ b/k8s/network-policy.yaml
@@ -86,15 +86,18 @@ spec:
     - protocol: TCP
       port: 8080
   # Allow to IAM (Authentik) for JWKS fetch + API
+  # Authentik pod listens on 9000 (http) and 9443 (https)
+  # Service translates 80→9000, 443→9443
+  # NetworkPolicy matches destination pod port, not service port
   - to:
     - namespaceSelector:
         matchLabels:
           kubernetes.io/metadata.name: iam
     ports:
     - protocol: TCP
-      port: 80
+      port: 9000
     - protocol: TCP
-      port: 443
+      port: 9443
   # Allow to SQS (queue management service)
   - to:
     - namespaceSelector: