diff --git a/kubernetes/apps/authentik/ldap-outpost-cnp.yaml b/kubernetes/apps/authentik/ldap-outpost-cnp.yaml
index ba94ead5..9ac9a956 100644
--- a/kubernetes/apps/authentik/ldap-outpost-cnp.yaml
+++ b/kubernetes/apps/authentik/ldap-outpost-cnp.yaml
@@ -34,3 +34,10 @@ spec:
               protocol: TCP
             - port: "6636"
               protocol: TCP
+    # The UDM's LDAPS admin-auth sync.
+    - fromCIDRSet:
+        - cidrGroupRef: udm-k8s-ingress
+      toPorts:
+        - ports:
+            - port: "6636"
+              protocol: TCP
diff --git a/kubernetes/infrastructure/network-policies/cidr-groups.yaml b/kubernetes/infrastructure/network-policies/cidr-groups.yaml
index 0ee9df84..64c9f81d 100644
--- a/kubernetes/infrastructure/network-policies/cidr-groups.yaml
+++ b/kubernetes/infrastructure/network-policies/cidr-groups.yaml
@@ -74,6 +74,17 @@ spec:
     - fd02:47::/64
     - 10.2.47.0/24
 ---
+# The UDM's own address on k8s-ingress, which it sources from towards the
+# cluster's LoadBalancer IPs.
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: udm-k8s-ingress
+spec:
+  externalCIDRs:
+    - fd02:47::1/128
+    - 10.2.47.1/32
+---
 apiVersion: cilium.io/v2
 kind: CiliumCIDRGroup
 metadata: