diff --git a/services/hermes/networkpolicy.yaml b/services/hermes/networkpolicy.yaml
index 30f2e8d4..dbddb0fb 100644
--- a/services/hermes/networkpolicy.yaml
+++ b/services/hermes/networkpolicy.yaml
@@ -406,13 +406,23 @@ spec:
       ports:
         - {protocol: TCP, port: 9005}
         - {protocol: TCP, port: 9009}
-    # HUX-12 evidence producer: the Kubernetes API (ClusterIP) for pod and
-    # Flux facts, and the ingress edge for Jenkins/Harbor/health receipts.
+    # Read-only Kubernetes API for the cluster_read tool and the HUX-12
+    # producer: the ClusterIP (some CNIs match pre-DNAT) and the real
+    # control-plane apiserver endpoints on 6443 (post-DNAT target; the
+    # 192.168/16 except-block below would otherwise drop these), plus the
+    # ingress edge for Jenkins/Harbor/health receipts.
     - to:
         - ipBlock:
             cidr: 10.43.0.1/32
+        - ipBlock:
+            cidr: 192.168.22.11/32
+        - ipBlock:
+            cidr: 192.168.22.12/32
+        - ipBlock:
+            cidr: 192.168.22.13/32
       ports:
         - {protocol: TCP, port: 443}
+        - {protocol: TCP, port: 6443}
     - to:
         - namespaceSelector:
             matchLabels: