diff --git a/sso-mfa/k8s/network-policies/netpol-sso.yaml b/sso-mfa/k8s/network-policies/netpol-sso.yaml
index 18b43ad..7da5c8b 100644
--- a/sso-mfa/k8s/network-policies/netpol-sso.yaml
+++ b/sso-mfa/k8s/network-policies/netpol-sso.yaml
@@ -7,6 +7,7 @@
 #
 # Allowed ingress paths:
 #   Traefik → keycape  :8080   (OIDC endpoints, user-facing)
+#   user-engine → keycape :8080 (OIDC token exchange and discovery)
 #   Traefik → authelia :9091   (login portal, user-facing)
 #   Traefik → lldap    :17170  (admin web UI; IP-restricted at Traefik layer)
 #
@@ -56,6 +57,30 @@ spec:
         - port: 8080
           protocol: TCP
 ---
+# ── user-engine → KeyCape :8080 ──────────────────────────────────────────────
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-user-engine-to-keycape
+  namespace: sso
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: keycape
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: user-engine
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: user-engine
+      ports:
+        - port: 8080
+          protocol: TCP
+---
 # ── Traefik → Authelia :9091 ──────────────────────────────────────────────────
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
diff --git a/sso-mfa/k8s/verify-t02.sh b/sso-mfa/k8s/verify-t02.sh
index a110531..3d499d7 100755
--- a/sso-mfa/k8s/verify-t02.sh
+++ b/sso-mfa/k8s/verify-t02.sh
@@ -63,6 +63,7 @@ for ns in sso mfa databases; do
         $KUBECTL get networkpolicy allow-egress-dns -n "$ns"
 done
 check "allow-traefik-to-keycape in sso"          $KUBECTL get networkpolicy allow-traefik-to-keycape -n sso
+check "allow-user-engine-to-keycape in sso"      $KUBECTL get networkpolicy allow-user-engine-to-keycape -n sso
 check "allow-keycape-egress-to-privacyidea in sso" $KUBECTL get networkpolicy allow-keycape-egress-to-privacyidea -n sso
 check "allow-ingress-from-traefik in mfa"       $KUBECTL get networkpolicy allow-ingress-from-traefik -n mfa
 check "allow-ingress-from-keycape in mfa"       $KUBECTL get networkpolicy allow-ingress-from-keycape -n mfa