diff --git a/kubernetes/apps/monitoring-rules/probes-blackbox.yaml b/kubernetes/apps/monitoring-rules/probes-blackbox.yaml
index 4d1cdb98..7b7d9d79 100644
--- a/kubernetes/apps/monitoring-rules/probes-blackbox.yaml
+++ b/kubernetes/apps/monitoring-rules/probes-blackbox.yaml
@@ -104,12 +104,15 @@ spec:
         # cnp-cross-namespace-allow-apps-gatus-to-monitored-services fails to
         # apply here. It applies: its Generalization section names
         # blackbox-exporter by hand. The reason we are safe is that the allow
-        # that note demands is ALREADY PRESENT — the navidrome baseline CNP
-        # admits the whole monitoring namespace on every port
-        # (infrastructure/network-policies/navidrome-ns.yaml:25-27), which is
-        # where blackbox-exporter runs. Run that check for the next namespace
-        # you add; do not skip it on the grounds that the note "is about
-        # gatus". Nothing in the navidrome namespace is edited by this change.
+        # that note demands is PRESENT AND DEDICATED — the navidrome baseline
+        # CNP (infrastructure/network-policies/navidrome-ns.yaml) admits
+        # blackbox-exporter by pod label on exactly the two listeners these
+        # two probes reach, :4533 and :8686. It used to admit the whole
+        # monitoring namespace on every port; REN-28 narrowed it, and the
+        # ports in that rule are the ones these probes depend on, so a probe
+        # added here against a THIRD listener in that namespace would need
+        # that rule widened first. Run that check for the next namespace you
+        # add; do not skip it on the grounds that the note "is about gatus".
         #
         # EGRESS — the half the wiki note is silent on, and the half that is
         # actually load-bearing here. Cilium enforces at BOTH ends, so the
diff --git a/kubernetes/apps/navidrome/deployment.yaml b/kubernetes/apps/navidrome/deployment.yaml
index 9b449fa8..f8071976 100644
--- a/kubernetes/apps/navidrome/deployment.yaml
+++ b/kubernetes/apps/navidrome/deployment.yaml
@@ -18,12 +18,18 @@ data:
   # "the outpost and Traefik" — default-deny-ingress in
   # kubernetes/infrastructure/network-policies/navidrome-ns.yaml uses
   # `endpointSelector: {}` and admits, on every port:
-  #   - the navidrome namespace     (navidrome-ns.yaml:9-11)
-  #   - traefik                     (navidrome-ns.yaml:13-16)
-  #   - the navidrome-gate outpost  (navidrome-ns.yaml:17-20)
-  #   - the lidarr-gate outpost     (navidrome-ns.yaml:21-24) - reaches navidrome too
-  #   - the monitoring namespace    (navidrome-ns.yaml:25-27)
-  #   - host / remote-node          (navidrome-ns.yaml:28-30)
+  #   - the navidrome namespace, every port
+  #   - traefik, every port
+  #   - the navidrome-gate outpost, every port
+  #   - the lidarr-gate outpost, every port - reaches navidrome too
+  #   - host / remote-node, every port - the kubelet sources the HTTP probes
+  #     from the host netns, so this one can never be removed while the pod
+  #     has HTTP probes
+  #   - blackbox-exporter on :4533 and :8686 only
+  # The whole-monitoring-namespace admit that used to be in this list was
+  # narrowed to blackbox-exporter on those two ports in REN-28. Rules are
+  # cited by what they admit, not by line number, so this list cannot go
+  # stale the next time that file is edited.
   # The value stays at the pod CIDR ON PURPOSE - see REN-28. The address
   # navidrome sees is the outpost's POD IP, which is not stable across
   # reschedules, so a narrower literal here fails open-ended and silently
diff --git a/kubernetes/infrastructure/network-policies/navidrome-ns.yaml b/kubernetes/infrastructure/network-policies/navidrome-ns.yaml
index 663a5c3a..66c81133 100644
--- a/kubernetes/infrastructure/network-policies/navidrome-ns.yaml
+++ b/kubernetes/infrastructure/network-policies/navidrome-ns.yaml
@@ -22,9 +22,28 @@ spec:
         - matchLabels:
             "k8s:io.kubernetes.pod.namespace": authentik
             goauthentik.io/outpost-name: lidarr-gate
+    # blackbox-exporter only, on the two app listeners — NOT the whole
+    # monitoring namespace, which this used to admit on every port (REN-28).
+    # Both apps take identity from X-Authentik-Username unconditionally, so
+    # every pod that can open a TCP connection to one of these listeners can
+    # claim any username; a namespace-wide admit put every current and future
+    # monitoring workload inside that boundary.
+    #
+    # NOTE: Cilium matches the POD port after service translation. The probes
+    # in monitoring-rules/probes-blackbox.yaml target :80 on the Services,
+    # which resolve to containerPort 4533 (navidrome/deployment.yaml) and 8686
+    # (navidrome/lidarr.yaml). `port: "80"` here would read clean in review and
+    # break both probes.
     - fromEndpoints:
         - matchLabels:
             "k8s:io.kubernetes.pod.namespace": monitoring
+            app.kubernetes.io/name: prometheus-blackbox-exporter
+      toPorts:
+        - ports:
+            - port: "4533"
+              protocol: TCP
+            - port: "8686"
+              protocol: TCP
     - fromEntities:
         - host
         - remote-node