diff --git a/apps/authentik/networkpolicy.yaml b/apps/authentik/networkpolicy.yaml
index 96190a8..00ebe4e 100644
--- a/apps/authentik/networkpolicy.yaml
+++ b/apps/authentik/networkpolicy.yaml
@@ -38,10 +38,12 @@ spec:
             matchLabels:
               kubernetes.io/metadata.name: matrix
       ports:
+        # NetworkPolicy matches the pod's actual container port, not the Service's
+        # external port - the authentik-server Service maps 80->9000, 443->9443.
         - protocol: TCP
-          port: 80
+          port: 9000
         - protocol: TCP
-          port: 443
+          port: 9443
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy