diff --git a/kube/deploy/core/_networking/cilium/netpols/labelled-allow-egress.yaml b/kube/deploy/core/_networking/cilium/netpols/labelled-allow-egress.yaml
index f01c7fd6..c26ea818 100644
--- a/kube/deploy/core/_networking/cilium/netpols/labelled-allow-egress.yaml
+++ b/kube/deploy/core/_networking/cilium/netpols/labelled-allow-egress.yaml
@@ -461,6 +461,7 @@ spec:
   egress:
     - # direct
       toFQDNs:
+        - matchPattern: "*.mullvad.net"
         - matchPattern: "*.relays.mullvad.net"
     - # SOCKS5 proxy
       toCIDRSet: