diff --git a/kubernetes/apps/monitoring-rules/kustomization.yaml b/kubernetes/apps/monitoring-rules/kustomization.yaml
index 5a04463e..77c38b74 100644
--- a/kubernetes/apps/monitoring-rules/kustomization.yaml
+++ b/kubernetes/apps/monitoring-rules/kustomization.yaml
@@ -4,6 +4,7 @@ kind: Kustomization
 # come from the kube-prometheus-stack chart. Flux applies this Kustomization
 # only after `monitoring` is Ready (chart installed → CRDs present).
 resources:
+  - prometheusrule-cilium.yaml
   - prometheusrule-hetzner-backup.yaml
   - prometheusrule-loki.yaml
   - prometheusrule-netbird-availability.yaml
diff --git a/kubernetes/apps/monitoring-rules/prometheusrule-cilium.yaml b/kubernetes/apps/monitoring-rules/prometheusrule-cilium.yaml
new file mode 100644
index 00000000..e5ba6f98
--- /dev/null
+++ b/kubernetes/apps/monitoring-rules/prometheusrule-cilium.yaml
@@ -0,0 +1,44 @@
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: cilium
+  namespace: monitoring
+  labels:
+    # kube-prometheus-stack's Prometheus resource selects on this label;
+    # without it the rule is created but never loaded into Prometheus.
+    release: kube-prometheus-stack
+spec:
+  groups:
+    - name: cilium.rules
+      # Both alerts are map-agnostic on purpose. cilium_bpf_map_pressure is
+      # emitted per map type — policy, conntrack, NAT, LB — distinguished by
+      # the map_name label, and running out of any of them degrades the
+      # datapath. The policy map is merely the one that has bitten us.
+      # Cilium only exports the metric for maps above
+      # policyMapPressureMetricsThreshold (chart default 0.1), so quiet maps
+      # produce no series rather than a flood of near-zero ones.
+      rules:
+        - alert: CiliumBPFMapPressureHigh
+          # cilium_bpf_map_pressure is used/capacity for the fullest map of
+          # that name on the agent. A full map is not a slow path — it is a
+          # hard failure: the agent cannot program the datapath, so endpoint
+          # regeneration fails and every new pod on the node hangs in sandbox
+          # creation until something frees space.
+          expr: cilium_bpf_map_pressure > 0.8
+          for: 15m
+          labels:
+            severity: warning
+          annotations:
+            summary: "Cilium BPF map {{ $labels.map_name }} is {{ $value | humanizePercentage }} full on {{ $labels.node }}"
+            description: "The BPF map {{ $labels.map_name }} on node {{ $labels.node }} has been over 80% full for 15 minutes. At 100% the Cilium agent can no longer program the datapath and new pods on this node fail sandbox creation. Raise the corresponding size in kubernetes/infrastructure/cilium/helmrelease.yaml (values.bpf) — the map is sized at creation, so the change needs an agent restart."
+
+        - alert: CiliumBPFMapFull
+          # Pressure reaches (and can exceed) 1.0 when the agent wants more
+          # entries than the map holds. Pods are already failing to start.
+          expr: cilium_bpf_map_pressure >= 1
+          for: 0m
+          labels:
+            severity: critical
+          annotations:
+            summary: "Cilium BPF map {{ $labels.map_name }} is full on {{ $labels.node }}"
+            description: "The BPF map {{ $labels.map_name }} on node {{ $labels.node }} is at or over capacity. Endpoint regeneration is failing with 'no space left on device' and pods scheduled to this node will hang in ContainerCreating. Check `{namespace=\"kube-system\",pod=~\"cilium-.+\"} |= \"no space left on device\"` in Loki for the affected endpoints."
diff --git a/kubernetes/infrastructure/cilium/helmrelease.yaml b/kubernetes/infrastructure/cilium/helmrelease.yaml
index 3f797a4b..108241df 100644
--- a/kubernetes/infrastructure/cilium/helmrelease.yaml
+++ b/kubernetes/infrastructure/cilium/helmrelease.yaml
@@ -17,7 +17,11 @@ spec:
   chart:
     spec:
       chart: cilium
-      version: ">=1.19.0"
+      # Patch-only range: Flux reconciles every 30m and would otherwise take a
+      # CNI minor or major unattended. Widening this is a deliberate, reviewed
+      # act — a minor bump changes datapath behaviour and rolls 2 of 3 agents
+      # at once.
+      version: ">=1.20.0 <1.21.0"
       sourceRef:
         kind: HelmRepository
         name: cilium
@@ -29,6 +33,16 @@ spec:
     remediation:
       retries: 3
   values:
+    # Which pod labels feed security-identity computation. Patterns are
+    # start-anchored regexes; a leading "!" excludes while keeping the default
+    # set. Woodpecker stamps every step pod with woodpecker-ci.org/task-uuid
+    # and step=<name>, so without this each build step is its own identity —
+    # and every identity costs one entry per allowed (direction, proto, port)
+    # in every endpoint's policy map, cluster-wide. Nothing selects on these
+    # labels in policy, so they buy identity churn and nothing else.
+    # Keep in lockstep with kubernetes/talos/patches/cilium-cni.yaml and
+    # kubernetes/talos/cilium.yaml.
+    labels: '!woodpecker-ci\.org/.* !step$'
     ipv6:
       enabled: true
     ipam:
@@ -46,6 +60,19 @@ spec:
       serviceMonitor:
         enabled: true
     bpf:
+      # Size of each endpoint's own cilium_policy_v3_<id> map, holding one
+      # entry per (identity, direction, protocol, port) the endpoint is
+      # allowed. When it fills, endpoint regeneration fails with "no space
+      # left on device", the CNI ADD call never returns, and the pod is stuck
+      # in sandbox creation — so this must stay comfortably above the busiest
+      # endpoint's entry count, tracked by cilium_bpf_map_pressure.
+      # Takes effect on agent restart; the map is sized at creation.
+      # Bootstrap installs Cilium from the inline manifest in
+      # kubernetes/talos/patches/cilium-cni.yaml, so bpf-policy-map-max there
+      # must move with this value or a cold rebuild starts with the old size.
+      # kubernetes/talos/cilium.yaml carries a third copy of the same key.
+      # Nothing enforces any of this; grep bpf-policy-map-max before changing it.
+      policyMapMax: 65536
       # Let pods reach the cluster's own LoadBalancer external IPs; Cilium
       # redirects the socket directly to the backend pod instead of sending
       # traffic out to the VIP and back (which fails with L2 announcements).
diff --git a/kubernetes/infrastructure/network-policies/audiobookshelf-ns.yaml b/kubernetes/infrastructure/network-policies/audiobookshelf-ns.yaml
index b65ce7a2..e68714de 100644
--- a/kubernetes/infrastructure/network-policies/audiobookshelf-ns.yaml
+++ b/kubernetes/infrastructure/network-policies/audiobookshelf-ns.yaml
@@ -31,43 +31,20 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
   egress:
     - toEndpoints:
         - matchLabels:
@@ -103,40 +80,17 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
diff --git a/kubernetes/infrastructure/network-policies/authentik-ns.yaml b/kubernetes/infrastructure/network-policies/authentik-ns.yaml
index 33fc0946..21aebf1a 100644
--- a/kubernetes/infrastructure/network-policies/authentik-ns.yaml
+++ b/kubernetes/infrastructure/network-policies/authentik-ns.yaml
@@ -38,43 +38,20 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
   egress:
     - toEndpoints:
         - matchLabels:
@@ -103,40 +80,17 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
diff --git a/kubernetes/infrastructure/network-policies/crowdsec-ns.yaml b/kubernetes/infrastructure/network-policies/crowdsec-ns.yaml
index ce52e359..62a50dd8 100644
--- a/kubernetes/infrastructure/network-policies/crowdsec-ns.yaml
+++ b/kubernetes/infrastructure/network-policies/crowdsec-ns.yaml
@@ -36,40 +36,17 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
diff --git a/kubernetes/infrastructure/network-policies/database-ns.yaml b/kubernetes/infrastructure/network-policies/database-ns.yaml
index 1a862f24..74171fed 100644
--- a/kubernetes/infrastructure/network-policies/database-ns.yaml
+++ b/kubernetes/infrastructure/network-policies/database-ns.yaml
@@ -32,40 +32,17 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
diff --git a/kubernetes/infrastructure/network-policies/evcc-ns.yaml b/kubernetes/infrastructure/network-policies/evcc-ns.yaml
index 10fdf9ff..430c3c68 100644
--- a/kubernetes/infrastructure/network-policies/evcc-ns.yaml
+++ b/kubernetes/infrastructure/network-policies/evcc-ns.yaml
@@ -27,43 +27,20 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
   egress:
     - toEndpoints:
         - matchLabels:
@@ -102,40 +79,17 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
diff --git a/kubernetes/infrastructure/network-policies/external-secrets-ns.yaml b/kubernetes/infrastructure/network-policies/external-secrets-ns.yaml
index c40d9500..6edd77e1 100644
--- a/kubernetes/infrastructure/network-policies/external-secrets-ns.yaml
+++ b/kubernetes/infrastructure/network-policies/external-secrets-ns.yaml
@@ -28,43 +28,20 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
   egress:
     - toEndpoints:
         - matchLabels:
@@ -103,40 +80,17 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
diff --git a/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml b/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml
index 40015b8d..b1144fcc 100644
--- a/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml
+++ b/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml
@@ -157,44 +157,21 @@ spec:
       icmps:
         - fields:
             - { type: 0,   family: IPv4 }   # Echo Reply
-            - { type: 3,   family: IPv4 }   # Destination Unreachable
-            - { type: 4,   family: IPv4 }   # Source Quench
-            - { type: 5,   family: IPv4 }   # Redirect
+            - { type: 3,   family: IPv4 }   # Destination Unreachable — PMTUD
             - { type: 8,   family: IPv4 }   # Echo Request
-            - { type: 9,   family: IPv4 }   # Router Advertisement
-            - { type: 10,  family: IPv4 }   # Router Solicitation
             - { type: 11,  family: IPv4 }   # Time Exceeded
             - { type: 12,  family: IPv4 }   # Parameter Problem
-            - { type: 13,  family: IPv4 }   # Timestamp
-            - { type: 14,  family: IPv4 }   # Timestamp Reply
-            - { type: 15,  family: IPv4 }   # Information Request
-            - { type: 16,  family: IPv4 }   # Information Reply
-            - { type: 17,  family: IPv4 }   # Address Mask Request
-            - { type: 18,  family: IPv4 }   # Address Mask Reply
-            - { type: 30,  family: IPv4 }   # Traceroute
             - { type: 1,   family: IPv6 }   # Destination Unreachable
-            - { type: 2,   family: IPv6 }   # Packet Too Big
+            - { type: 2,   family: IPv6 }   # Packet Too Big — PMTUD, mandatory
             - { type: 3,   family: IPv6 }   # Time Exceeded
             - { type: 4,   family: IPv6 }   # Parameter Problem
             - { type: 128, family: IPv6 }   # Echo Request
             - { type: 129, family: IPv6 }   # Echo Reply
-            - { type: 130, family: IPv6 }   # Multicast Listener Query
-            - { type: 131, family: IPv6 }   # Multicast Listener Report
-            - { type: 132, family: IPv6 }   # Multicast Listener Done
             - { type: 133, family: IPv6 }   # Router Solicitation
             - { type: 134, family: IPv6 }   # Router Advertisement
             - { type: 135, family: IPv6 }   # Neighbor Solicitation
             - { type: 136, family: IPv6 }   # Neighbor Advertisement
-            - { type: 137, family: IPv6 }   # Redirect
-            - { type: 138, family: IPv6 }   # Router Renumbering
-            - { type: 141, family: IPv6 }   # Inverse ND Solicitation
-            - { type: 142, family: IPv6 }   # Inverse ND Advertisement
             - { type: 143, family: IPv6 }   # MLDv2 Listener Report
-            - { type: 148, family: IPv6 }   # Certification Path Solicitation
-            - { type: 149, family: IPv6 }   # Certification Path Advertisement
-            - { type: 151, family: IPv6 }   # Multicast Router Advertisement
-            - { type: 152, family: IPv6 }   # Multicast Router Solicitation
-            - { type: 153, family: IPv6 }   # Multicast Router Termination
   egress:
     # Cluster-internal callers HA initiates connections to: mosquitto,
     # whisper, matter-server, etc.
@@ -253,43 +230,20 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
 ---
 # Scoped world ingress — replaces the former namespace-wide `fromEntities:
 # world` allow (see the note in the default-deny-ingress policy above). IoT-VLAN
diff --git a/kubernetes/infrastructure/network-policies/immich-ns.yaml b/kubernetes/infrastructure/network-policies/immich-ns.yaml
index 30632202..ebcf3fe6 100644
--- a/kubernetes/infrastructure/network-policies/immich-ns.yaml
+++ b/kubernetes/infrastructure/network-policies/immich-ns.yaml
@@ -42,40 +42,17 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
diff --git a/kubernetes/infrastructure/network-policies/influxdb-ns.yaml b/kubernetes/infrastructure/network-policies/influxdb-ns.yaml
index b85ea85c..3febdaa6 100644
--- a/kubernetes/infrastructure/network-policies/influxdb-ns.yaml
+++ b/kubernetes/infrastructure/network-policies/influxdb-ns.yaml
@@ -42,40 +42,17 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
diff --git a/kubernetes/infrastructure/network-policies/monitoring-ns.yaml b/kubernetes/infrastructure/network-policies/monitoring-ns.yaml
index 0571ee6d..493e8ac5 100644
--- a/kubernetes/infrastructure/network-policies/monitoring-ns.yaml
+++ b/kubernetes/infrastructure/network-policies/monitoring-ns.yaml
@@ -67,40 +67,17 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
diff --git a/kubernetes/infrastructure/network-policies/paperless-ns.yaml b/kubernetes/infrastructure/network-policies/paperless-ns.yaml
index bebfca06..4856b540 100644
--- a/kubernetes/infrastructure/network-policies/paperless-ns.yaml
+++ b/kubernetes/infrastructure/network-policies/paperless-ns.yaml
@@ -37,43 +37,20 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
   egress:
     - toEndpoints:
         - matchLabels:
@@ -109,43 +86,20 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
 ---
 # Allow FTP access (from scanners on the LAN) to the ftp-scanner pod.
 apiVersion: cilium.io/v2
diff --git a/kubernetes/infrastructure/network-policies/rook-ceph-ns.yaml b/kubernetes/infrastructure/network-policies/rook-ceph-ns.yaml
index e23d570d..b9bf0450 100644
--- a/kubernetes/infrastructure/network-policies/rook-ceph-ns.yaml
+++ b/kubernetes/infrastructure/network-policies/rook-ceph-ns.yaml
@@ -41,40 +41,17 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
diff --git a/kubernetes/infrastructure/network-policies/spegel-ns.yaml b/kubernetes/infrastructure/network-policies/spegel-ns.yaml
index e7febeab..8b3e7a80 100644
--- a/kubernetes/infrastructure/network-policies/spegel-ns.yaml
+++ b/kubernetes/infrastructure/network-policies/spegel-ns.yaml
@@ -26,43 +26,20 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
   egress:
     # Peer P2P
     - toEndpoints:
@@ -92,40 +69,17 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
diff --git a/kubernetes/infrastructure/network-policies/trmnl-ns.yaml b/kubernetes/infrastructure/network-policies/trmnl-ns.yaml
index 2f354f40..fdb6b7b2 100644
--- a/kubernetes/infrastructure/network-policies/trmnl-ns.yaml
+++ b/kubernetes/infrastructure/network-policies/trmnl-ns.yaml
@@ -42,43 +42,20 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
 ---
 # The TRMNL panel polls /api/display over cleartext HTTP on the
 # terminus-device LoadBalancer. The firmware cannot be handed the internal
diff --git a/kubernetes/infrastructure/network-policies/velero-ns.yaml b/kubernetes/infrastructure/network-policies/velero-ns.yaml
index d9507f9a..2cb50b09 100644
--- a/kubernetes/infrastructure/network-policies/velero-ns.yaml
+++ b/kubernetes/infrastructure/network-policies/velero-ns.yaml
@@ -28,40 +28,17 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
diff --git a/kubernetes/infrastructure/network-policies/woodpecker-ci-ns.yaml b/kubernetes/infrastructure/network-policies/woodpecker-ci-ns.yaml
index df8e8b9e..85d31313 100644
--- a/kubernetes/infrastructure/network-policies/woodpecker-ci-ns.yaml
+++ b/kubernetes/infrastructure/network-policies/woodpecker-ci-ns.yaml
@@ -45,40 +45,17 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
diff --git a/kubernetes/infrastructure/network-policies/wordpress-ns.yaml b/kubernetes/infrastructure/network-policies/wordpress-ns.yaml
index a97b1105..b316dd15 100644
--- a/kubernetes/infrastructure/network-policies/wordpress-ns.yaml
+++ b/kubernetes/infrastructure/network-policies/wordpress-ns.yaml
@@ -53,43 +53,20 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
   egress:
     - toEndpoints:
         - matchLabels:
@@ -128,40 +105,17 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
diff --git a/kubernetes/talos/cilium.yaml b/kubernetes/talos/cilium.yaml
index 66280704..97df107c 100644
--- a/kubernetes/talos/cilium.yaml
+++ b/kubernetes/talos/cilium.yaml
@@ -249,6 +249,11 @@ data:
 
   identity-heartbeat-timeout: "30m0s"
   identity-gc-interval: "15m0s"
+  # Exclude Woodpecker's per-build labels from identity computation, so CI
+  # steps share one identity instead of minting one each. Keep in lockstep
+  # with patches/cilium-cni.yaml and values.labels in
+  # kubernetes/infrastructure/cilium/helmrelease.yaml.
+  labels: '!woodpecker-ci\.org/.* !step$'
   cilium-endpoint-gc-interval: "5m0s"
   nodes-gc-interval: "5m0s"
 
@@ -302,8 +307,9 @@ data:
   # sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps.
   bpf-map-dynamic-size-ratio: "0.0025"
   # bpf-policy-map-max specifies the maximum number of entries in endpoint
-  # policy map (per endpoint)
-  bpf-policy-map-max: "16384"
+  # policy map (per endpoint). Keep in lockstep with patches/cilium-cni.yaml and
+  # values.bpf.policyMapMax in kubernetes/infrastructure/cilium/helmrelease.yaml.
+  bpf-policy-map-max: "65536"
   # bpf-policy-stats-map-max specifies the maximum number of entries in global
   # policy stats map
   bpf-policy-stats-map-max: "65536"
diff --git a/kubernetes/talos/patches/cilium-cni.yaml b/kubernetes/talos/patches/cilium-cni.yaml
index b1c4f5b8..57ec25a1 100644
--- a/kubernetes/talos/patches/cilium-cni.yaml
+++ b/kubernetes/talos/patches/cilium-cni.yaml
@@ -267,6 +267,11 @@ cluster:
         
           identity-heartbeat-timeout: "30m0s"
           identity-gc-interval: "15m0s"
+          # Exclude Woodpecker's per-build labels from identity computation, so
+          # CI steps share one identity instead of minting one each. Keep in
+          # lockstep with values.labels in
+          # kubernetes/infrastructure/cilium/helmrelease.yaml.
+          labels: '!woodpecker-ci\.org/.* !step$'
           cilium-endpoint-gc-interval: "5m0s"
           nodes-gc-interval: "5m0s"
         
@@ -320,8 +325,12 @@ cluster:
           # sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps.
           bpf-map-dynamic-size-ratio: "0.0025"
           # bpf-policy-map-max specifies the maximum number of entries in endpoint
-          # policy map (per endpoint)
-          bpf-policy-map-max: "16384"
+          # policy map (per endpoint). Keep in lockstep with values.bpf.policyMapMax
+          # in kubernetes/infrastructure/cilium/helmrelease.yaml, and with the third
+          # copy in kubernetes/talos/cilium.yaml: bootstrap installs Cilium from this
+          # inline manifest, so a lower value here means a cold rebuild comes up with
+          # a map that overflows until Flux reconciles.
+          bpf-policy-map-max: "65536"
           # bpf-policy-stats-map-max specifies the maximum number of entries in global
           # policy stats map
           bpf-policy-stats-map-max: "65536"