diff --git a/charts/apl-network-policies/templates/networkpolicies/external-secrets.yaml b/charts/apl-network-policies/templates/networkpolicies/external-secrets.yaml
new file mode 100644
index 0000000000..61b2ab75ba
--- /dev/null
+++ b/charts/apl-network-policies/templates/networkpolicies/external-secrets.yaml
@@ -0,0 +1,37 @@
+{{- if .Values.netpols.externalSecrets }}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: external-secrets-platform-policy
+  namespace: external-secrets
+  labels:
+    {{- include "apl-network-policies.labels" . | nindent 4 }}
+    app: external-secrets
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: external-secrets-webhook
+  policyTypes:
+    - Ingress
+  ingress:
+    # Allow the apiserver to reach the validating / conversion webhook.
+    # The apiserver is off the pod network on a managed control plane (LKE / LKE-E) and has no
+    # address that a namespaceSelector or ipBlock can pin down, so this rule is scoped by port
+    # rather than by source. Without it every ClusterSecretStore/ExternalSecret create or update
+    # times out against the webhook.
+    - ports:
+        - protocol: TCP
+          port: 10250
+    # Allow monitoring access
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              name: monitoring
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/instance: po-prometheus
+      ports:
+        - protocol: TCP
+          port: 8080
+{{- end }}
diff --git a/charts/apl-network-policies/values.yaml b/charts/apl-network-policies/values.yaml
index 7c0f0a7adb..e3343d2b43 100644
--- a/charts/apl-network-policies/values.yaml
+++ b/charts/apl-network-policies/values.yaml
@@ -32,5 +32,13 @@
 #   * Monitoring namespace (for metrics scraping)
 #   * Internal otomi namespace communication
 #
+# For external-secrets (netpols.externalSecrets: true):
+# - Creates a NetworkPolicy in the external-secrets namespace, scoped to the webhook pods
+# - Allows ingress from:
+#   * anywhere on the webhook port 10250 — the apiserver calls the validating/conversion
+#     webhook, and on a managed control plane it is off the pod network with no address a
+#     selector or ipBlock can pin down, so the rule is scoped by port instead of by source
+#   * Monitoring namespace on 8080 (for metrics scraping)
+#
 # The complex network policy rules are baked into the chart templates,
 # so users only need to toggle network policies on/off per application.
diff --git a/helmfile.d/snippets/defaults.yaml b/helmfile.d/snippets/defaults.yaml
index 7d9d569960..0008c1c57f 100644
--- a/helmfile.d/snippets/defaults.yaml
+++ b/helmfile.d/snippets/defaults.yaml
@@ -960,6 +960,8 @@ environments:
                   memory: 1Gi
             _rawValues: {}
           external-secrets:
+            networkPolicies:
+              enabled: false
             resources:
               operator:
                 requests:
diff --git a/values-schema.yaml b/values-schema.yaml
index 9502538c98..aa500b7671 100644
--- a/values-schema.yaml
+++ b/values-schema.yaml
@@ -1631,6 +1631,8 @@ properties:
         properties:
           _rawValues:
             $ref: '#/definitions/rawValues'
+          networkPolicies:
+            $ref: '#/definitions/appNetworkPolicyConfig'
           resources:
             properties:
               operator:
diff --git a/values/apl-network-policies/apl-network-policies.gotmpl b/values/apl-network-policies/apl-network-policies.gotmpl
index cb3798134e..37e8a16d9b 100644
--- a/values/apl-network-policies/apl-network-policies.gotmpl
+++ b/values/apl-network-policies/apl-network-policies.gotmpl
@@ -1,12 +1,14 @@
 {{- $v := .Values }}
 {{- $a := $v.apps }}
 {{- $oa := $v.apps | get "otomi-api" }}
+{{- $es := $v.apps | get "external-secrets" }}
 
 # Simple per-app network policy configuration
 netpols:
   gitServer: {{ not ($a | get "git-server.enabled") }}
   gitea: {{ $a.gitea.networkPolicies.enabled}}
   otomiApi: {{ $oa.networkPolicies.enabled}}
+  externalSecrets: {{ $es.networkPolicies.enabled}}
 
 ingressGatewaySelectors:
   - namespaceSelector: