diff --git a/Makefile b/Makefile
index 8ae25de..ee0c589 100644
--- a/Makefile
+++ b/Makefile
@@ -47,6 +47,7 @@ deploy-dry-run: ## Server-side validate the railiance01 manifests
 	  -f deploy/audit-core.yaml \
 	  -f deploy/senders-scope.yaml \
 	  -f deploy/networkpolicies.yaml \
+	  -f deploy/migrate-egress.yaml \
 	  -f deploy/clustersecretstore.yaml \
 	  -f deploy/externalsecrets.yaml \
 	  -f deploy/migrate-job.yaml
diff --git a/deploy/README.md b/deploy/README.md
index e9264fc..f04ec59 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -8,13 +8,29 @@ the server port or export a copy before applying.
 Apply order is documented in `docs/operator-runbook.md`. Do not apply the
 Deployment until:
 
-1. The image digest is pinned (currently `sha256:ec15f63d…` from commit `bc3d80f`).
+1. The image digest is pinned (currently `sha256:b479801b…` built from source commit `5227fb14e47f26a01930be4611360fd90f740662`).
 2. Secrets `audit-core-database`, `audit-core-database-migrate`, and
    `audit-core-senders` exist. ConfigMap `audit-core-senders-scope` is
    applied (`deploy/senders-scope.yaml`) before the Deployment mounts it.
-3. Job `audit-core-migrate` has completed.
+3. Apply `deploy/migrate-egress.yaml` before starting the migration Job.
+   The default-deny policy selects every pod, while the receiver egress policy
+   deliberately selects component `receiver` only. Migration pods need their
+   own exact component `migrate` exception: DNS TCP/UDP53 to kube-dns in
+   kube-system and PostgreSQL TCP5432 to platform-pg pods in databases.
+   No API-server access or service account token is needed.
+4. Job `audit-core-migrate` has completed and ledger includes
+   `0007-import-receipts` before the current receiver image is released.
 
 ```bash
 make image-build
 make deploy-dry-run
 ```
+
+The 2026-10-15 NK-WP-0035 migration retries exposed this missing dedicated
+egress exception: the first two attempts could not resolve/reach PostgreSQL.
+The bounded policy is retained as source so future releases do not depend on
+an undocumented repair. Both receiver and migration Job pin immutable image
+`forgejo.coulomb.social/coulomb/audit-core@sha256:b479801b0bc76df66a36a85376c45aaf399c6d82feade9ba81430b774c4a8271`,
+built from source `5227fb14e47f26a01930be4611360fd90f740662`; this follow-up
+changes deployment configuration only and requires no image rebuild. Migration
+0007 adds import receipts and indexes without changing existing event rows.
diff --git a/deploy/audit-core.yaml b/deploy/audit-core.yaml
index b38ea49..b6621ba 100644
--- a/deploy/audit-core.yaml
+++ b/deploy/audit-core.yaml
@@ -86,7 +86,7 @@ spec:
         - name: audit-core
           # REPLACE at release time with the built digest. A mutable tag is not
           # an immutable image, and `:latest` must never be the only reference.
-          image: forgejo.coulomb.social/coulomb/audit-core@sha256:ec15f63d49226bfe507af2bc38ffbd5e83f549ba2c6d1ae7a338e7e053f34615
+          image: forgejo.coulomb.social/coulomb/audit-core@sha256:b479801b0bc76df66a36a85376c45aaf399c6d82feade9ba81430b774c4a8271
           imagePullPolicy: IfNotPresent
           ports:
             - name: http
diff --git a/deploy/migrate-egress.yaml b/deploy/migrate-egress.yaml
new file mode 100644
index 0000000..91d70f0
--- /dev/null
+++ b/deploy/migrate-egress.yaml
@@ -0,0 +1,69 @@
+{
+  "apiVersion": "networking.k8s.io/v1",
+  "kind": "NetworkPolicy",
+  "metadata": {
+    "name": "audit-core-migrate-egress",
+    "namespace": "audit-core"
+  },
+  "spec": {
+    "podSelector": {
+      "matchLabels": {
+        "app.kubernetes.io/name": "audit-core",
+        "app.kubernetes.io/component": "migrate"
+      }
+    },
+    "policyTypes": [
+      "Egress"
+    ],
+    "egress": [
+      {
+        "to": [
+          {
+            "namespaceSelector": {
+              "matchLabels": {
+                "kubernetes.io/metadata.name": "databases"
+              }
+            },
+            "podSelector": {
+              "matchLabels": {
+                "cnpg.io/cluster": "platform-pg"
+              }
+            }
+          }
+        ],
+        "ports": [
+          {
+            "protocol": "TCP",
+            "port": 5432
+          }
+        ]
+      },
+      {
+        "to": [
+          {
+            "namespaceSelector": {
+              "matchLabels": {
+                "kubernetes.io/metadata.name": "kube-system"
+              }
+            },
+            "podSelector": {
+              "matchLabels": {
+                "k8s-app": "kube-dns"
+              }
+            }
+          }
+        ],
+        "ports": [
+          {
+            "protocol": "UDP",
+            "port": 53
+          },
+          {
+            "protocol": "TCP",
+            "port": 53
+          }
+        ]
+      }
+    ]
+  }
+}
diff --git a/deploy/migrate-job.yaml b/deploy/migrate-job.yaml
index 95df935..8718cf6 100644
--- a/deploy/migrate-job.yaml
+++ b/deploy/migrate-job.yaml
@@ -24,6 +24,7 @@ spec:
         app.kubernetes.io/name: audit-core
         app.kubernetes.io/component: migrate
     spec:
+      automountServiceAccountToken: false
       restartPolicy: OnFailure
       securityContext:
         runAsNonRoot: true
@@ -33,7 +34,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: migrate
-          image: forgejo.coulomb.social/coulomb/audit-core@sha256:ec15f63d49226bfe507af2bc38ffbd5e83f549ba2c6d1ae7a338e7e053f34615
+          image: forgejo.coulomb.social/coulomb/audit-core@sha256:b479801b0bc76df66a36a85376c45aaf399c6d82feade9ba81430b774c4a8271
           imagePullPolicy: IfNotPresent
           command: ["python", "-m", "audit_core", "migrate"]
           env: