diff --git a/infra/k8s/argo/argo-workflow-netpol.yaml b/infra/k8s/argo/argo-workflow-netpol.yaml
index a38d1dbd4..4d2ce0e98 100644
--- a/infra/k8s/argo/argo-workflow-netpol.yaml
+++ b/infra/k8s/argo/argo-workflow-netpol.yaml
@@ -12,6 +12,12 @@ spec:
   policyTypes:
     - Egress
   egress:
+    # DNS — required for hostname resolution (minio, gitlab, etc.)
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
     # Kubernetes API — Argo executor reports task results
     - ports:
         - port: 443
@@ -23,7 +29,29 @@ spec:
             cidr: 10.32.0.0/16
         - ipBlock:
             cidr: 172.16.0.4/32
-    # MinIO — binary fetch + result upload
+    # HTTPS (external registries, etc.)
+    - ports:
+        - port: 443
+          protocol: TCP
+    # GitLab SSH — git clone
+    - ports:
+        - port: 2222
+          protocol: TCP
+      to:
+        - ipBlock:
+            cidr: 100.90.76.85/32
+        - podSelector:
+            matchLabels:
+              app: gitlab-shell
+    # GitLab API — binary fetch from packages
+    - ports:
+        - port: 8181
+          protocol: TCP
+      to:
+        - podSelector:
+            matchLabels:
+              app: webservice
+    # MinIO — log archival + result upload
     - ports:
         - port: 9000
           protocol: TCP
@@ -31,6 +59,14 @@ spec:
         - podSelector:
             matchLabels:
               app.kubernetes.io/name: minio
+    # Pushgateway — Prometheus metrics
+    - ports:
+        - port: 9091
+          protocol: TCP
+      to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: pushgateway
     # Tempo — OTLP traces
     - ports:
         - port: 4317
@@ -47,6 +83,14 @@ spec:
         - podSelector:
             matchLabels:
               app.kubernetes.io/name: mattermost
+    # Container registry — image pulls
+    - ports:
+        - port: 5000
+          protocol: TCP
+      to:
+        - podSelector:
+            matchLabels:
+              app: registry
 ---
 # Compile workflow pods: need GitLab SSH, MinIO, k8s API, external HTTPS (cargo deps)
 apiVersion: networking.k8s.io/v1