diff --git a/infra/k8s/network-policies/monitoring-service.yaml b/infra/k8s/network-policies/monitoring-service.yaml
new file mode 100644
index 000000000..f5ae526bb
--- /dev/null
+++ b/infra/k8s/network-policies/monitoring-service.yaml
@@ -0,0 +1,37 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: monitoring-service
+  namespace: foxhunt
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: monitoring-service
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    # gRPC from web-gateway
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: web-gateway
+      ports:
+        - protocol: TCP
+          port: 50057
+  egress:
+    # Prometheus HTTP API (port 80)
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: prometheus
+      ports:
+        - protocol: TCP
+          port: 80
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: prometheus
+      ports:
+        - protocol: TCP
+          port: 9090
diff --git a/infra/k8s/network-policies/web-gateway.yaml b/infra/k8s/network-policies/web-gateway.yaml
index 82ca9eeaa..2db45d085 100644
--- a/infra/k8s/network-policies/web-gateway.yaml
+++ b/infra/k8s/network-policies/web-gateway.yaml
@@ -59,6 +59,14 @@ spec:
       ports:
         - protocol: TCP
           port: 50056
+    # Monitoring service gRPC
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: monitoring-service
+      ports:
+        - protocol: TCP
+          port: 50057
     # Minio (initContainer binary fetch)
     - to:
         - podSelector: