diff --git a/kubernetes/personal/openclaw/kustomization.yaml b/kubernetes/personal/openclaw/kustomization.yaml
index c6dc919..87ed777 100644
--- a/kubernetes/personal/openclaw/kustomization.yaml
+++ b/kubernetes/personal/openclaw/kustomization.yaml
@@ -6,3 +6,4 @@ resources:
   - openclaw-secrets.yaml
   - networkpolicy.yaml
   - networkpolicy-mail-egress.yaml
+  - networkpolicy-radicale-egress.yaml
diff --git a/kubernetes/personal/openclaw/networkpolicy-radicale-egress.yaml b/kubernetes/personal/openclaw/networkpolicy-radicale-egress.yaml
new file mode 100644
index 0000000..d2f210b
--- /dev/null
+++ b/kubernetes/personal/openclaw/networkpolicy-radicale-egress.yaml
@@ -0,0 +1,25 @@
+# Supplementary egress policy: the operator's managed default-deny NetworkPolicy
+# only allows DNS + TCP 443 outbound, which blocks HTTP/CalDAV to Radicale.
+# The CR field spec.networkPolicy.additionalEgress would be the native fix,
+# but it is not in the CRD bundled with chart 0.39.0 yet (silently pruned).
+# Revisit after upgrading the operator.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: openclaw-radicale-egress
+  namespace: openclaw
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: openclaw
+      app.kubernetes.io/name: openclaw
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: radicale
+      ports:
+        - port: 5232
+          protocol: TCP
\ No newline at end of file