diff --git a/kubernetes/personal/openclaw/openclaw-instance.yaml b/kubernetes/personal/openclaw/openclaw-instance.yaml
index facac0f..a7fc28b 100644
--- a/kubernetes/personal/openclaw/openclaw-instance.yaml
+++ b/kubernetes/personal/openclaw/openclaw-instance.yaml
@@ -26,6 +26,11 @@ spec:
         forceHTTPS: false
       annotations:
         external-dns.alpha.kubernetes.io/enabled: "true"
+  # Operator's default-deny NetworkPolicy only allows same-namespace ingress;
+  # allow Traefik so the Ingress route can reach the gateway proxy.
+  networkPolicy:
+    allowedIngressNamespaces:
+      - traefik
   resources:
     requests:
       cpu: 250m