diff --git a/infra/k8s/network-policies/allow-dns.yaml b/infra/k8s/network-policies/allow-dns.yaml
index d9d3a0bd4..83f69d446 100644
--- a/infra/k8s/network-policies/allow-dns.yaml
+++ b/infra/k8s/network-policies/allow-dns.yaml
@@ -1,4 +1,4 @@
-# Allow all pods to reach CoreDNS (kube-system) for name resolution.
+# Allow all foxhunt + CI pods to reach CoreDNS (kube-system) for name resolution.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -8,8 +8,10 @@ metadata:
     app.kubernetes.io/part-of: foxhunt
 spec:
   podSelector:
-    matchLabels:
-      app.kubernetes.io/part-of: foxhunt
+    matchExpressions:
+      - key: app.kubernetes.io/part-of
+        operator: In
+        values: [foxhunt, foxhunt-ci]
   policyTypes:
     - Egress
   egress:
diff --git a/infra/k8s/network-policies/ci-egress.yaml b/infra/k8s/network-policies/ci-egress.yaml
new file mode 100644
index 000000000..2fc012915
--- /dev/null
+++ b/infra/k8s/network-policies/ci-egress.yaml
@@ -0,0 +1,18 @@
+# CI executor pods need broad egress: git clone (GitLab webservice), container
+# registries, kubectl (K8s API), MinIO S3, and external tool downloads.
+# These pods are ephemeral (minutes) — fine-grained egress adds little value.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: ci-egress
+  namespace: foxhunt
+  labels:
+    app.kubernetes.io/part-of: foxhunt
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/part-of: foxhunt-ci
+  policyTypes:
+    - Egress
+  egress:
+    - {}