diff --git a/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml b/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml
index 2cae52bb..f78238ab 100644
--- a/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml
+++ b/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml
@@ -44,6 +44,60 @@ spec:
     # bypassing Cilium policy entirely; this CNP rule does not gate it.
     - fromEntities:
         - world
+    # ICMP — all standard ICMPv4 and ICMPv6 types from any cluster pod.
+    # Per Cilium docs, "If any layer 4 policy is specified, then ICMP
+    # will be blocked unless it's related to a connection that is
+    # otherwise allowed by the policy." The CT-RELATED path is not
+    # passing these in practice (Hubble shows ICMPv6 DestinationUnreachable
+    # being POLICY_DENIED on the egress side of established DNS flows),
+    # so allow ICMP explicitly. Same shape as commit 3c517a0 — widened
+    # from the error class to the full standard type set. Cilium's
+    # ICMPField requires an explicit type per entry; no wildcard.
+    - fromEndpoints:
+        - matchExpressions:
+            - key: io.kubernetes.pod.namespace
+              operator: Exists
+      icmps:
+        - fields:
+            - { type: 0,   family: IPv4 }   # Echo Reply
+            - { type: 3,   family: IPv4 }   # Destination Unreachable
+            - { type: 4,   family: IPv4 }   # Source Quench
+            - { type: 5,   family: IPv4 }   # Redirect
+            - { type: 8,   family: IPv4 }   # Echo Request
+            - { type: 9,   family: IPv4 }   # Router Advertisement
+            - { type: 10,  family: IPv4 }   # Router Solicitation
+            - { type: 11,  family: IPv4 }   # Time Exceeded
+            - { type: 12,  family: IPv4 }   # Parameter Problem
+            - { type: 13,  family: IPv4 }   # Timestamp
+            - { type: 14,  family: IPv4 }   # Timestamp Reply
+            - { type: 15,  family: IPv4 }   # Information Request
+            - { type: 16,  family: IPv4 }   # Information Reply
+            - { type: 17,  family: IPv4 }   # Address Mask Request
+            - { type: 18,  family: IPv4 }   # Address Mask Reply
+            - { type: 30,  family: IPv4 }   # Traceroute
+            - { type: 1,   family: IPv6 }   # Destination Unreachable
+            - { type: 2,   family: IPv6 }   # Packet Too Big
+            - { type: 3,   family: IPv6 }   # Time Exceeded
+            - { type: 4,   family: IPv6 }   # Parameter Problem
+            - { type: 128, family: IPv6 }   # Echo Request
+            - { type: 129, family: IPv6 }   # Echo Reply
+            - { type: 130, family: IPv6 }   # Multicast Listener Query
+            - { type: 131, family: IPv6 }   # Multicast Listener Report
+            - { type: 132, family: IPv6 }   # Multicast Listener Done
+            - { type: 133, family: IPv6 }   # Router Solicitation
+            - { type: 134, family: IPv6 }   # Router Advertisement
+            - { type: 135, family: IPv6 }   # Neighbor Solicitation
+            - { type: 136, family: IPv6 }   # Neighbor Advertisement
+            - { type: 137, family: IPv6 }   # Redirect
+            - { type: 138, family: IPv6 }   # Router Renumbering
+            - { type: 141, family: IPv6 }   # Inverse ND Solicitation
+            - { type: 142, family: IPv6 }   # Inverse ND Advertisement
+            - { type: 143, family: IPv6 }   # MLDv2 Listener Report
+            - { type: 148, family: IPv6 }   # Certification Path Solicitation
+            - { type: 149, family: IPv6 }   # Certification Path Advertisement
+            - { type: 151, family: IPv6 }   # Multicast Router Advertisement
+            - { type: 152, family: IPv6 }   # Multicast Router Solicitation
+            - { type: 153, family: IPv6 }   # Multicast Router Termination
   egress:
     # Cluster-internal callers HA initiates connections to: mosquitto,
     # whisper, matter-server, etc.
@@ -90,3 +144,52 @@ spec:
     # endpoints (Hue, Roomba, Philips, Brother IPP, …).
     - toEntities:
         - world
+    # ICMP — egress mirror of the ingress ICMP allow above. Lets HA
+    # send ICMP to any cluster pod (covers the kernel's ICMPv6
+    # Destination Unreachable when CoreDNS responses land on a
+    # closed source port, plus ping etc).
+    - toEndpoints:
+        - matchExpressions:
+            - key: io.kubernetes.pod.namespace
+              operator: Exists
+      icmps:
+        - fields:
+            - { type: 0,   family: IPv4 }
+            - { type: 3,   family: IPv4 }
+            - { type: 4,   family: IPv4 }
+            - { type: 5,   family: IPv4 }
+            - { type: 8,   family: IPv4 }
+            - { type: 9,   family: IPv4 }
+            - { type: 10,  family: IPv4 }
+            - { type: 11,  family: IPv4 }
+            - { type: 12,  family: IPv4 }
+            - { type: 13,  family: IPv4 }
+            - { type: 14,  family: IPv4 }
+            - { type: 15,  family: IPv4 }
+            - { type: 16,  family: IPv4 }
+            - { type: 17,  family: IPv4 }
+            - { type: 18,  family: IPv4 }
+            - { type: 30,  family: IPv4 }
+            - { type: 1,   family: IPv6 }
+            - { type: 2,   family: IPv6 }
+            - { type: 3,   family: IPv6 }
+            - { type: 4,   family: IPv6 }
+            - { type: 128, family: IPv6 }
+            - { type: 129, family: IPv6 }
+            - { type: 130, family: IPv6 }
+            - { type: 131, family: IPv6 }
+            - { type: 132, family: IPv6 }
+            - { type: 133, family: IPv6 }
+            - { type: 134, family: IPv6 }
+            - { type: 135, family: IPv6 }
+            - { type: 136, family: IPv6 }
+            - { type: 137, family: IPv6 }
+            - { type: 138, family: IPv6 }
+            - { type: 141, family: IPv6 }
+            - { type: 142, family: IPv6 }
+            - { type: 143, family: IPv6 }
+            - { type: 148, family: IPv6 }
+            - { type: 149, family: IPv6 }
+            - { type: 151, family: IPv6 }
+            - { type: 152, family: IPv6 }
+            - { type: 153, family: IPv6 }