diff --git a/apps/base/iuclabs-runners/networkpolicy-iuclabs-k8s.yaml b/apps/base/iuclabs-runners/networkpolicy-iuclabs-k8s.yaml
new file mode 100644
index 0000000..4b2377d
--- /dev/null
+++ b/apps/base/iuclabs-runners/networkpolicy-iuclabs-k8s.yaml
@@ -0,0 +1,45 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: egress-iuclabs-k8s
+  namespace: iuclabs-runners
+spec:
+  podSelector:
+    matchLabels:
+      runners.unkin.net/scale-set: iuclabs-k8s
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+              - 198.18.0.0/15
+              - 0.0.0.0/8
+              - 100.64.0.0/10
+              - 127.0.0.0/8
+              - 169.254.0.0/16
+              - 224.0.0.0/4
+              - 240.0.0.0/4
+      ports:
+        - protocol: TCP
+          port: 443
+    # vault.service.consul servers, from `dig vault.service.consul`
+    - to:
+        - ipBlock:
+            cidr: 198.18.25.78/32
+        - ipBlock:
+            cidr: 198.18.26.197/32
+        - ipBlock:
+            cidr: 198.18.27.116/32
+        - ipBlock:
+            cidr: 198.18.28.248/32
+        - ipBlock:
+            cidr: 198.18.29.92/32
+      ports:
+        - protocol: TCP
+          port: 8200
diff --git a/apps/base/iuclabs-runners/networkpolicy.yaml b/apps/base/iuclabs-runners/networkpolicy.yaml
index bcf7a7d..8602217 100644
--- a/apps/base/iuclabs-runners/networkpolicy.yaml
+++ b/apps/base/iuclabs-runners/networkpolicy.yaml
@@ -2,13 +2,23 @@
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
-  name: runners
+  name: default-deny
   namespace: iuclabs-runners
 spec:
   podSelector: {}
   policyTypes:
     - Ingress
     - Egress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-dns
+  namespace: iuclabs-runners
+spec:
+  podSelector: {}
+  policyTypes:
+    - Egress
   egress:
     - to:
         - namespaceSelector:
@@ -22,35 +32,3 @@ spec:
           port: 53
         - protocol: TCP
           port: 53
-    - to:
-        - ipBlock:
-            cidr: 0.0.0.0/0
-            except:
-              - 10.0.0.0/8
-              - 172.16.0.0/12
-              - 192.168.0.0/16
-              - 198.18.0.0/15
-              - 0.0.0.0/8
-              - 100.64.0.0/10
-              - 127.0.0.0/8
-              - 169.254.0.0/16
-              - 224.0.0.0/4
-              - 240.0.0.0/4
-      ports:
-        - protocol: TCP
-          port: 443
-    # vault.service.consul servers, from `dig vault.service.consul`
-    - to:
-        - ipBlock:
-            cidr: 198.18.25.78/32
-        - ipBlock:
-            cidr: 198.18.26.197/32
-        - ipBlock:
-            cidr: 198.18.27.116/32
-        - ipBlock:
-            cidr: 198.18.28.248/32
-        - ipBlock:
-            cidr: 198.18.29.92/32
-      ports:
-        - protocol: TCP
-          port: 8200