diff --git a/infra/k8s/orchestration/dagster.yaml b/infra/k8s/orchestration/dagster.yaml
index e75ba33..5514740 100644
--- a/infra/k8s/orchestration/dagster.yaml
+++ b/infra/k8s/orchestration/dagster.yaml
@@ -204,5 +204,7 @@ spec:
     - to: [{ namespaceSelector: { matchLabels: { kubernetes.io/metadata.name: gitea } }, podSelector: { matchLabels: { app.kubernetes.io/name: gitea } } }]   # git-sync clones from the bizworx gitea in ns gitea (cross-namespace)
       ports: [{ port: 2222, protocol: TCP }, { port: 22, protocol: TCP }]
     - ports: [{ port: 53, protocol: UDP }, { port: 53, protocol: TCP }]
+    - to: [{ ipBlock: { cidr: 10.32.0.1/32 } }]   # kube-apiserver ClusterIP: the tailscale sidecar reads/writes its ts-state Secret via kubernetes.default.svc (the public-HTTPS rule below excepts the service CIDR)
+      ports: [{ port: 443, protocol: TCP }]
     - to: [{ ipBlock: { cidr: 0.0.0.0/0, except: [10.32.0.0/16, 172.16.0.0/16] } }]   # Binance/Databento + tailscale
       ports: [{ port: 443, protocol: TCP }, { port: 3478, protocol: UDP }, { port: 41641, protocol: UDP }]