diff --git a/infrastructure/istio/manifests/apps/authorization-policies-apps.yaml b/infrastructure/istio/manifests/apps/authorization-policies-apps.yaml
index 60e3ad0..293b2ca 100644
--- a/infrastructure/istio/manifests/apps/authorization-policies-apps.yaml
+++ b/infrastructure/istio/manifests/apps/authorization-policies-apps.yaml
@@ -107,6 +107,17 @@ spec:
         - source:
             namespaces:
               - prometheus
+    # CNPG operator (cnpg-system) polling pg-n8n instances' status API
+    # (port 8000). Missing here despite being needed for the exact same
+    # reason as authentik/nextcloud/crowdsec - found 2026-08-17: this was
+    # the actual cause of pg-n8n's long-recurring "Instance Status
+    # Extraction Error" (100% reproducible connection resets from
+    # cnpg-system, not the intermittent HBONE-tunnel issue it looked like
+    # from the outside). Matches nextcloud's broader ipBlocks fallback.
+    - from:
+        - source:
+            ipBlocks:
+              - "10.244.0.0/16"
 
 ---
 # --- Nextcloud: Allow ingress + Prometheus + intra-namespace ---