diff --git a/infra/k8s/network-policies/fxhnt-cockpit.yaml b/infra/k8s/network-policies/fxhnt-cockpit.yaml
index 443bcc4..a9a8970 100644
--- a/infra/k8s/network-policies/fxhnt-cockpit.yaml
+++ b/infra/k8s/network-policies/fxhnt-cockpit.yaml
@@ -28,8 +28,10 @@ spec:
     - ports:                                    # DNS
         - { port: 53, protocol: UDP }
         - { port: 53, protocol: TCP }
-    - to:                                       # tailscale sidecar -> coordination/DERP (public internet)
-        - ipBlock: { cidr: 0.0.0.0/0, except: [10.32.0.0/16, 100.64.0.0/15] }
+    - to: [{ ipBlock: { cidr: 172.16.0.11/32 } }]   # kube-apiserver REAL endpoint (kube-proxy DNATs kubernetes.default.svc 10.32.0.1:443 -> this before NP eval). The tailscale sidecar reads/writes its ts-state Secret via the apiserver — WITHOUT this it crashloops "context deadline exceeded" on a fresh start (e.g. after the deploy scale-0->1), causing a bad gateway. Mirrors the dagster NP fix (06d12fd).
+      ports: [{ port: 6443, protocol: TCP }]
+    - to:                                       # tailscale sidecar -> coordination/DERP (public internet). except now includes 172.16.0.0/16 so the apiserver rule above is the only cluster-internal path.
+        - ipBlock: { cidr: 0.0.0.0/0, except: [10.32.0.0/16, 100.64.0.0/15, 172.16.0.0/16] }
       ports:
         - { port: 443, protocol: TCP }
         - { port: 3478, protocol: UDP }