diff --git a/kubernetes/infra/ingress/cloudflared/README.md b/kubernetes/infra/ingress/cloudflared/README.md
index 4edb0c8..6ca4243 100644
--- a/kubernetes/infra/ingress/cloudflared/README.md
+++ b/kubernetes/infra/ingress/cloudflared/README.md
@@ -23,9 +23,10 @@ Cloudflare.
 
 - The tunnel token is committed only as a SealedSecret and mounted as a read-only file.
 - The pods do not receive Kubernetes API credentials and run as a non-root user with a read-only filesystem.
-- Egress permits cluster DNS, the named Cilium Gateway Service, and Cloudflare on TCP or UDP `7844` with TCP
-  `443` for management and fallback. The Gateway Service rule intentionally omits `toPorts` because Cilium
-  evaluates L4 policy after Service translation and represents the listener with a synthetic target port.
+- Egress permits cluster DNS, Cilium's `ingress` identity, the Grafana backend on TCP `3000`, the Hubble UI
+  backend on TCP `8081`, and Cloudflare on TCP or UDP `7844` with TCP `443` for management and fallback.
+  Cilium Gateway hairpin traffic crosses the `ingress` identity before reaching a routed backend, so the
+  policy allows those identities directly instead of relying on the selectorless Gateway Service.
 - Prometheus is the only permitted inbound consumer of the connector metrics endpoint.
 - Cloudflare route configuration remains remotely managed until the external boundary is imported into
   OpenTofu. The dashboard configuration is therefore an explicit temporary manual dependency.
diff --git a/kubernetes/infra/ingress/cloudflared/network-policy.yaml b/kubernetes/infra/ingress/cloudflared/network-policy.yaml
index 6d8ebb0..a51cb79 100644
--- a/kubernetes/infra/ingress/cloudflared/network-policy.yaml
+++ b/kubernetes/infra/ingress/cloudflared/network-policy.yaml
@@ -29,10 +29,24 @@ spec:
           rules:
             dns:
               - matchPattern: "*"
-    - toServices:
-        - k8sService:
-            serviceName: cilium-gateway-lan-gateway
-            namespace: gateway-system
+    - toEntities:
+        - ingress
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: monitoring
+            k8s:app.kubernetes.io/name: grafana
+      toPorts:
+        - ports:
+            - port: "3000"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s:app.kubernetes.io/name: hubble-ui
+      toPorts:
+        - ports:
+            - port: "8081"
+              protocol: TCP
     - toEntities:
         - world
       toPorts: