diff --git a/kubernetes/infrastructure/network-policies/trmnl-ns.yaml b/kubernetes/infrastructure/network-policies/trmnl-ns.yaml
index 9d00e05e..021f962a 100644
--- a/kubernetes/infrastructure/network-policies/trmnl-ns.yaml
+++ b/kubernetes/infrastructure/network-policies/trmnl-ns.yaml
@@ -62,9 +62,10 @@ spec:
 # CA, so this bypasses Traefik entirely and the namespace default-deny has
 # to be opened for it — same shape as paperless's allow-ftp-scanner.
 #
-# Scoped to the terminus pods and port 2345 only. Requests still have to
-# carry a known device MAC in the `ID` header plus its api_key; this rule
-# opens the port, not the application.
+# Scoped to the terminus pods, port 2345 and the IoT network (the panel's
+# network; the LB is ETP=Local, so the client address reaches the pod).
+# Requests still have to carry a known device MAC in the `ID` header plus
+# its api_key; this rule opens the port, not the application.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
@@ -75,8 +76,13 @@ spec:
     matchLabels:
       app.kubernetes.io/name: terminus
   ingress:
+    - fromCIDRSet:
+        - cidrGroupRef: net-iot
+      toPorts:
+        - ports:
+            - port: "2345"
+              protocol: TCP
     - fromEntities:
-        - world
         - host
         - remote-node
       toPorts: