diff --git a/services/hermes-chat/networkpolicy.yaml b/services/hermes-chat/networkpolicy.yaml
index c6cf5718d..7a5260b99 100644
--- a/services/hermes-chat/networkpolicy.yaml
+++ b/services/hermes-chat/networkpolicy.yaml
@@ -51,6 +51,18 @@ spec:
       ports:
         - protocol: TCP
           port: 443
+    # K3s applies egress policy after Service DNAT, so admit only the fixed API
+    # server endpoints as well as the kubernetes Service IP above.
+    - to:
+        - ipBlock:
+            cidr: 192.168.22.11/32
+        - ipBlock:
+            cidr: 192.168.22.12/32
+        - ipBlock:
+            cidr: 192.168.22.13/32
+      ports:
+        - protocol: TCP
+          port: 6443
     - to:
         - ipBlock:
             cidr: 0.0.0.0/0