diff --git a/kube/deploy/core/_networking/cilium/netpols/labelled-allow-egress.yaml b/kube/deploy/core/_networking/cilium/netpols/labelled-allow-egress.yaml
index 6ed28816..f01c7fd6 100644
--- a/kube/deploy/core/_networking/cilium/netpols/labelled-allow-egress.yaml
+++ b/kube/deploy/core/_networking/cilium/netpols/labelled-allow-egress.yaml
@@ -459,6 +459,9 @@ spec:
     matchLabels:
       egress.home.arpa/mullvad: allow
   egress:
+    - # direct
+      toFQDNs:
+        - matchPattern: "*.relays.mullvad.net"
     - # SOCKS5 proxy
       toCIDRSet:
         - cidr: "10.8.0.1/32"