diff --git a/k8s/infra/forgejo-runner/templates/networkpolicy.yaml b/k8s/infra/forgejo-runner/templates/networkpolicy.yaml
index baccba8..890de0a 100644
--- a/k8s/infra/forgejo-runner/templates/networkpolicy.yaml
+++ b/k8s/infra/forgejo-runner/templates/networkpolicy.yaml
@@ -29,13 +29,23 @@ spec:
             except:
               - 192.168.1.0/24
               - 10.244.0.0/16
-    # Single LAN exception: the ingress-nginx LoadBalancer, which is how
-    # forgejo.riotpiao.com resolves. Image pushes go to that name so the tag
-    # matches what containerd pulls on the nodes; without this the whole /24 is
-    # denied above and `docker push` hangs until it times out.
+    # ingress-nginx, which is how forgejo.riotpiao.com resolves (CoreDNS
+    # rewrites that name to ingress-nginx-controller.ingress-nginx.svc).
+    # Image pushes go to that name so the tag matches what containerd pulls
+    # on the nodes; without this the whole /24 and pod CIDR are denied above
+    # and `docker push`/`docker login` hang until they time out.
+    #
+    # Was an ipBlock pinned to the ingress-nginx LoadBalancer's LAN IP. That
+    # stopped matching once DNS started resolving the name to the Service's
+    # ClusterIP instead of the LB IP: Cilium enforces egress against the
+    # post-DNAT pod IP, which falls inside the 10.244.0.0/16 exclusion above,
+    # so every request silently hung rather than erroring. A namespaceSelector
+    # follows the Service wherever it resolves and needs no IP to stay in
+    # sync with -- same pattern as the kube-system DNS rule above.
     - to:
-        - ipBlock:
-            cidr: {{ .Values.egress.ingressLoadBalancerIP }}/32
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: ingress-nginx
       ports:
         - protocol: TCP
           port: 443
diff --git a/k8s/infra/forgejo-runner/values.yaml b/k8s/infra/forgejo-runner/values.yaml
index 3b6f9b1..4e4df63 100644
--- a/k8s/infra/forgejo-runner/values.yaml
+++ b/k8s/infra/forgejo-runner/values.yaml
@@ -47,10 +47,3 @@ tolerations:
 # attach there.
 nodeSelector:
   topology.kubernetes.io/zone: az-a
-
-# Egress exceptions. The NetworkPolicy denies the whole LAN /24 by default;
-# this is the one address punched back through, because forgejo.riotpiao.com
-# (the image registry) resolves to the ingress-nginx LoadBalancer.
-# Must match the Cilium LB pool allocation — pool is 192.168.1.160/28.
-egress:
-  ingressLoadBalancerIP: 192.168.1.160