diff --git a/apps/authentik/authentik.yaml b/apps/authentik/authentik.yaml
index 0bb264d..5098bc4 100644
--- a/apps/authentik/authentik.yaml
+++ b/apps/authentik/authentik.yaml
@@ -98,3 +98,8 @@ spec:
             memory: 256Mi
           limits:
             memory: 512Mi
+        # Chart's own generated policy allows ANY pod in ANY namespace on 5432
+        # (see issue #37) - disabled in favor of our own scoped policy in
+        # apps/authentik/networkpolicy.yaml.
+        networkPolicy:
+          enabled: false
diff --git a/apps/authentik/networkpolicy.yaml b/apps/authentik/networkpolicy.yaml
index 00ebe4e..2881745 100644
--- a/apps/authentik/networkpolicy.yaml
+++ b/apps/authentik/networkpolicy.yaml
@@ -4,9 +4,10 @@
 # for upstream OIDC calls. Egress is intentionally untouched (federation-equivalent
 # outbound calls like SMTP aren't restricted here).
 #
-# Note: authentik-postgresql already has its own NetworkPolicy from the Bitnami
-# postgresql subchart (port 5432, no source restriction) - left alone, not duplicated,
-# since it would get reset on the next Helm upgrade anyway.
+# authentik-postgresql: the Bitnami postgresql subchart's own generated NetworkPolicy
+# restricted the port (5432) but not the source - any pod in any namespace could reach
+# it (issue #37). Disabled via postgresql.primary.networkPolicy.enabled: false in
+# authentik.yaml and replaced below with a policy scoped to authentik-server/-worker.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -47,6 +48,32 @@ spec:
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
+metadata:
+  name: allow-ingress-authentik-postgresql
+  namespace: authentik
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: postgresql
+      app.kubernetes.io/component: primary
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: authentik
+              app.kubernetes.io/component: server
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: authentik
+              app.kubernetes.io/component: worker
+      ports:
+        - protocol: TCP
+          port: 5432
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: allow-ingress-acme-solver
   namespace: authentik