diff --git a/helm/codeapi/templates/network-policy.yaml b/helm/codeapi/templates/network-policy.yaml
index fe24123f..be610689 100644
--- a/helm/codeapi/templates/network-policy.yaml
+++ b/helm/codeapi/templates/network-policy.yaml
@@ -168,6 +168,10 @@ spec:
     - ports:
         - protocol: TCP
           port: {{ .Values.api.service.port }}
+      {{- with (.Values.networkPolicy.api | default dict).ingressFrom }}
+      from:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
   egress:
     - to:
         - namespaceSelector: {}
diff --git a/helm/codeapi/values.yaml b/helm/codeapi/values.yaml
index 33c32af0..d38a4694 100644
--- a/helm/codeapi/values.yaml
+++ b/helm/codeapi/values.yaml
@@ -539,5 +539,11 @@ networkPolicy:
     # egress on the configured Redis port to any destination because standard
     # Kubernetes NetworkPolicy cannot target redis.external.host by DNS name.
     externalCIDRs: []
+  api:
+    # NetworkPolicy peers allowed to reach the API, e.g. only the pods of the
+    # application that calls it. Include your ingress controller when
+    # ingress.enabled, and Prometheus when metrics.enabled, as both use the
+    # same port. Empty allows any source.
+    ingressFrom: []
   toolCallServer:
     allowExternalEgress: false  # Allow tool call server to reach external APIs