diff --git a/src/server/services/network-policy.service.ts b/src/server/services/network-policy.service.ts
index 449c5fd3..b69b1cd1 100644
--- a/src/server/services/network-policy.service.ts
+++ b/src/server/services/network-policy.service.ts
@@ -165,6 +165,11 @@ class NetworkPolicyService {
         return {
             ingress: [{
                 from: [{
+                    namespaceSelector: {
+                        matchLabels: {
+                            'kubernetes.io/metadata.name': Constants.QS_NAMESPACE,
+                        },
+                    },
                     podSelector: {
                         matchLabels: {
                             app: QS_AUTH_PROXY_SERVICE_NAME,
diff --git a/src/server/services/network-policy.service.unit.spec.ts b/src/server/services/network-policy.service.unit.spec.ts
index 136a9269..cf2ed8db 100644
--- a/src/server/services/network-policy.service.unit.spec.ts
+++ b/src/server/services/network-policy.service.unit.spec.ts
@@ -59,7 +59,7 @@ describe('network-policy.service', () => {
         );
     });
 
-    it('allows ingress from auth proxy to all sandbox ports', () => {
+    it('allows auth proxy ingress from the quickstack namespace to all sandbox ports', () => {
         const policy = networkPolicyService.buildAgentSandboxTemplateNetworkPolicy({
             allowInternetAccess: false,
             rules: [],
@@ -67,6 +67,11 @@ describe('network-policy.service', () => {
 
         expect(policy?.ingress).toEqual([{
             from: [{
+                namespaceSelector: {
+                    matchLabels: {
+                        'kubernetes.io/metadata.name': 'quickstack',
+                    },
+                },
                 podSelector: {
                     matchLabels: {
                         app: 'qs-auth-proxy',