diff --git a/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml b/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml
index 3b974389..a003f768 100644
--- a/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml
+++ b/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml
@@ -541,6 +541,46 @@ spec:
             - port: "443"
               protocol: TCP
 ---
+# otbr: the SLZB-06P7 Thread radio (spinel over TCP) and the Ubuntu archive,
+# from which the container installs socat at startup.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: otbr-egress
+  namespace: home-assistant
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: otbr
+  egress:
+    # rules.dns lets Cilium learn the toFQDNs mapping
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
+    - toFQDNs:
+        - matchName: "slzb-thread.renner.uno"
+      toPorts:
+        - ports:
+            - port: "6638"
+              protocol: TCP
+    - toFQDNs:
+        - matchName: "archive.ubuntu.com"
+        - matchName: "security.ubuntu.com"
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
+---
 # mqtt-account-controller: credential delivery to deliver.esp32 targets in mqtt-accounts.yaml.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy