diff --git a/k8s/deployment-hrrr-point-rs.yaml b/k8s/deployment-hrrr-point-rs.yaml
index 5a1eecdb..ad9ea311 100644
--- a/k8s/deployment-hrrr-point-rs.yaml
+++ b/k8s/deployment-hrrr-point-rs.yaml
@@ -22,6 +22,7 @@ spec:
     rollingUpdate:
       maxSurge: 1
       maxUnavailable: 0
+  minReadySeconds: 5
   selector:
     matchLabels:
       app: hrrr-point-rs
diff --git a/k8s/hpa.yaml b/k8s/hpa.yaml
index a42a3d0f..c93167e7 100644
--- a/k8s/hpa.yaml
+++ b/k8s/hpa.yaml
@@ -9,8 +9,8 @@
 # for scheduler bin-packing without accidentally changing when HPA
 # decides to add a replica.
 #
-# The corresponding Deployments have their `spec.replicas` removed so
-# Flux's periodic reconcile doesn't fight HPA's live scaling.
+# The corresponding Deployments omit their spec.replicas so ArgoCD's
+# periodic reconcile doesn't fight HPA's live scaling.
 ---
 apiVersion: autoscaling/v2
 kind: HorizontalPodAutoscaler
diff --git a/k8s/kustomization.yaml b/k8s/kustomization.yaml
index 33d01447..04062d23 100644
--- a/k8s/kustomization.yaml
+++ b/k8s/kustomization.yaml
@@ -13,3 +13,5 @@ resources:
   - service.yaml
   - metrics-service.yaml
   - hpa.yaml
+  - pdb.yaml
+  - network-policy.yaml
diff --git a/k8s/network-policy.yaml b/k8s/network-policy.yaml
new file mode 100644
index 00000000..b55f8306
--- /dev/null
+++ b/k8s/network-policy.yaml
@@ -0,0 +1,108 @@
+# Minimal ingress policy for a home cluster. Default-deny within the
+# namespace, then allow:
+#   - Web traffic to hot pods on :5000 (cloudflared ingress)
+#   - Prometheus scrape traffic on :5000 (prop metrics) and :9100 (Rust workers)
+#   - Erlang distribution (EPMD + ephemeral ports) between prop + backfill pods
+#
+# Egress is unrestricted — pods need to reach Postgres, NFS (10.0.19.103),
+# HRRR (skippy + NOAA S3), and IEM.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: prop-allow-web
+  namespace: prop
+spec:
+  podSelector:
+    matchLabels:
+      app: prop
+      tier: hot
+  policyTypes:
+    - Ingress
+  ingress:
+    # Web traffic from cloudflared (any source, port :5000).
+    - from: []
+      ports:
+        - port: 5000
+          protocol: TCP
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: prop-allow-metrics
+  namespace: prop
+spec:
+  podSelector:
+    matchLabels:
+      app: prop
+      tier: hot
+  policyTypes:
+    - Ingress
+  ingress:
+    # Prometheus scrape via apiserver proxy or NodePort.
+    - from:
+        - namespaceSelector: {}   # any namespace
+      ports:
+        - port: 5000
+          protocol: TCP
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: grid-rs-allow-metrics
+  namespace: prop
+spec:
+  podSelector:
+    matchLabels:
+      app: prop-grid-rs
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector: {}
+      ports:
+        - port: 9100
+          protocol: TCP
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: hrrr-point-allow-metrics
+  namespace: prop
+spec:
+  podSelector:
+    matchLabels:
+      app: hrrr-point-rs
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector: {}
+      ports:
+        - port: 9100
+          protocol: TCP
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: prop-allow-epmd
+  namespace: prop
+spec:
+  podSelector:
+    matchLabels:
+      app: prop
+  policyTypes:
+    - Ingress
+  ingress:
+    # Erlang distribution within the cluster (libcluster). EPMD listens on
+    # 4369; actual distribution uses ephemeral ports negotiated via EPMD.
+    - from:
+        - podSelector:
+            matchLabels:
+              app: prop
+      ports:
+        - port: 4369
+          protocol: TCP
+    - from:
+        - podSelector:
+            matchLabels:
+              app: prop
diff --git a/k8s/pdb.yaml b/k8s/pdb.yaml
new file mode 100644
index 00000000..7d9bf8c4
--- /dev/null
+++ b/k8s/pdb.yaml
@@ -0,0 +1,11 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: prop
+  namespace: prop
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app: prop
+      tier: hot