diff --git a/kubernetes/apps/paperclip/network-policy.yaml b/kubernetes/apps/paperclip/network-policy.yaml
index 47dd0a5d..889ec05c 100644
--- a/kubernetes/apps/paperclip/network-policy.yaml
+++ b/kubernetes/apps/paperclip/network-policy.yaml
@@ -92,6 +92,14 @@ spec:
         - ports:
             - port: "4245"
               protocol: TCP
+    # edge-1 SSH as the forced-command user atlas-zwave (zwave-js restart and
+    # logs only; REN-627, access REN-628). Not a node IP, so toCIDRSet matches.
+    - toCIDRSet:
+        - cidr: 10.2.30.108/32
+      toPorts:
+        - ports:
+            - port: "22"
+              protocol: TCP
     - toEntities:
         - kube-apiserver
       toPorts: