diff --git a/services/hermes-scm-broker/networkpolicy.yaml b/services/hermes-scm-broker/networkpolicy.yaml
index 9c1a0542..4d6b238f 100644
--- a/services/hermes-scm-broker/networkpolicy.yaml
+++ b/services/hermes-scm-broker/networkpolicy.yaml
@@ -48,5 +48,14 @@ spec:
     - to:
         - ipBlock:
             cidr: 192.168.22.9/32
+        # Pod egress to the forge VIP is DNAT-ed to the ingress pods before
+        # policy evaluation, so the VIP ipBlock alone never matches; allow the
+        # ingress pods themselves or every broker->forge read is rejected.
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
       ports:
         - {protocol: TCP, port: 443}