diff --git a/kubernetes/infrastructure/network-policies/ingress-isolation.yaml b/kubernetes/infrastructure/network-policies/ingress-isolation.yaml
index b9138aa7..30ecbcfc 100644
--- a/kubernetes/infrastructure/network-policies/ingress-isolation.yaml
+++ b/kubernetes/infrastructure/network-policies/ingress-isolation.yaml
@@ -88,8 +88,12 @@ spec:
     - toEntities:
         - world
 ---
-# Default deny ingress to ingress namespace from other namespaces
-# Allow from external (Cloudflare/MetalLB) and host (health probes)
+# Default deny ingress to ingress namespace from external sources only.
+# Any in-cluster pod may reach ingress-nginx (required for east-west
+# OIDC flows via k8s_gateway — audiobookshelf → Authentik etc.); we
+# don't enumerate namespaces, which would require policy edits every
+# time a new app lands. External entry is still bounded by the
+# Cloudflare-proxied / MetalLB / host probe paths.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
@@ -98,16 +102,8 @@ metadata:
 spec:
   endpointSelector: {}
   ingress:
-    - fromEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": ingress
-    - fromEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": apps
-    - fromEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": paperless
     - fromEntities:
+        - cluster
         - host
         - remote-node
         - world