diff --git a/infrastructure/cilium/manifests/network-policies/baseline.yaml b/infrastructure/cilium/manifests/network-policies/baseline.yaml
index 885e096..145fc39 100644
--- a/infrastructure/cilium/manifests/network-policies/baseline.yaml
+++ b/infrastructure/cilium/manifests/network-policies/baseline.yaml
@@ -22,11 +22,14 @@ spec:
         - host
         - kube-apiserver
         - remote-node
-    # Istio ingress gateway
+    # Ingress gateways
     - fromEndpoints:
         - matchLabels:
             k8s:io.kubernetes.pod.namespace: istio-system
             istio: ingressgateway
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: envoy-gateway-system
     # External Secrets Operator
     - fromEndpoints:
         - matchLabels:
@@ -55,10 +58,13 @@ spec:
         - host
         - kube-apiserver
         - remote-node
-    # Istio ingress gateway
+    # Ingress gateways
     - fromEndpoints:
         - matchLabels:
             k8s:io.kubernetes.pod.namespace: istio-system
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: envoy-gateway-system
     # Internal authentik traffic (server <-> worker, pg access)
     - fromEndpoints:
         - matchLabels: