diff --git a/kubernetes/infrastructure/network-policies/default-deny.yaml b/kubernetes/infrastructure/network-policies/default-deny.yaml
index b47ff68c..c59c2942 100644
--- a/kubernetes/infrastructure/network-policies/default-deny.yaml
+++ b/kubernetes/infrastructure/network-policies/default-deny.yaml
@@ -45,6 +45,17 @@ spec:
         - ports:
             - port: "1883"
               protocol: TCP
+    # woodpecker-secret-rotate CronJob writes WOODPECKER_AGENT_SECRET to the
+    # OpenBao KV API (:8200). Namespace-wide egress here is scoped in effect by
+    # openbao's own ingress policy (rotator pod only) — same pattern as the
+    # mosquitto rule above (see openbao-ns.yaml).
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": openbao
+      toPorts:
+        - ports:
+            - port: "8200"
+              protocol: TCP
     - toEntities:
         - host
         - remote-node
diff --git a/kubernetes/infrastructure/network-policies/openbao-ns.yaml b/kubernetes/infrastructure/network-policies/openbao-ns.yaml
index 222cad4e..430a162f 100644
--- a/kubernetes/infrastructure/network-policies/openbao-ns.yaml
+++ b/kubernetes/infrastructure/network-policies/openbao-ns.yaml
@@ -31,6 +31,18 @@ spec:
         - ports:
             - port: "8200"
               protocol: TCP
+    # woodpecker-secret-rotate CronJob (apps ns) writes WOODPECKER_AGENT_SECRET
+    # via the KV API. Scoped to the rotator pod labels — this ingress rule is the
+    # actual security boundary for the namespace-wide apps->openbao egress allow.
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": apps
+            app.kubernetes.io/name: woodpecker
+            app.kubernetes.io/component: secret-rotator
+      toPorts:
+        - ports:
+            - port: "8200"
+              protocol: TCP
   egress:
     # Adding an egress stanza flips this namespace from egress-unrestricted to
     # egress default-deny. The intent is to block lateral in-cluster egress —