diff --git a/k8s/cilium-netpol.yaml b/k8s/cilium-netpol.yaml
new file mode 100644
index 0000000..8cdc01f
--- /dev/null
+++ b/k8s/cilium-netpol.yaml
@@ -0,0 +1,12 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-kube-api
+  namespace: api
+spec:
+  endpointSelector:
+    matchLabels:
+      app: api-gateway
+  egress:
+  - toEntities:
+    - kube-apiserver
diff --git a/k8s/kustomization.yaml b/k8s/kustomization.yaml
index 9c99aea..4d2f2bd 100644
--- a/k8s/kustomization.yaml
+++ b/k8s/kustomization.yaml
@@ -9,6 +9,7 @@ resources:
 - service.yaml
 - deployment.yaml
 - network-policy.yaml
+- cilium-netpol.yaml
 - configmap.yaml
 
 # The deployed image tag lives here and nowhere else. CI publishes
diff --git a/k8s/network-policy.yaml b/k8s/network-policy.yaml
index 3f013cd..b31dde4 100644
--- a/k8s/network-policy.yaml
+++ b/k8s/network-policy.yaml
@@ -30,20 +30,9 @@ spec:
     - protocol: TCP
       port: 8080
   egress:
-  # Allow Kubernetes API server (ServiceAdapter CRD loader)
-  # ClusterIP VIP (10.96.0.1:443) + real control-plane endpoints (port 6443)
-  - to:
-    - ipBlock:
-        cidr: 10.96.0.1/32
-    ports:
-    - protocol: TCP
-      port: 443
-  - to:
-    - ipBlock:
-        cidr: 192.168.1.0/24
-    ports:
-    - protocol: TCP
-      port: 6443
+  # Kubernetes API server egress is handled by CiliumNetworkPolicy
+  # (k8s/cilium-netpol.yaml) using toEntities: kube-apiserver.
+  # Standard NetworkPolicy ipBlock doesn't work with Cilium for service VIPs.
   # Allow DNS
   - to:
     - namespaceSelector: