diff --git a/deploy/approval-service/40-networkpolicy.yaml b/deploy/approval-service/40-networkpolicy.yaml
index 74b12ab..88b3638 100644
--- a/deploy/approval-service/40-networkpolicy.yaml
+++ b/deploy/approval-service/40-networkpolicy.yaml
@@ -27,13 +27,18 @@ spec:
     - Ingress
     - Egress
   ingress:
-    # Public traffic reaches approval-service only via the Pangolin edge
-    # (Traefik lives inside the Pangolin namespace). Keep this list
-    # conservative — add additional callers on demand, not speculatively.
+    # Public traffic reaches approval-service via the Pangolin resource,
+    # but the actual TCP connection is made by the Traefik ingress pod
+    # in kube-system (Pangolin only renders the Traefik config; it does
+    # not sit in the request path). Keep this list conservative — add
+    # additional callers on demand, not speculatively.
     - from:
         - namespaceSelector:
             matchLabels:
-              kubernetes.io/metadata.name: pangolin
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
       ports:
         - port: 8080
           protocol: TCP