diff --git a/argocd/platform-addons/bao-notice/manifests.yaml b/argocd/platform-addons/bao-notice/manifests.yaml
index 6d83945..755857b 100644
--- a/argocd/platform-addons/bao-notice/manifests.yaml
+++ b/argocd/platform-addons/bao-notice/manifests.yaml
@@ -28,6 +28,29 @@ spec:
     - {protocol: TCP, port: 8080}
   egress: []
 ---
+# cert-manager HTTP-01 solver pods run in this namespace on 8089 during
+# issuance and renewal; Traefik must reach them or the challenge gets 502.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: bao-notice-acme-solver
+  namespace: bao-notice
+spec:
+  podSelector:
+    matchLabels:
+      acme.cert-manager.io/http01-solver: "true"
+  policyTypes: [Ingress]
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+      podSelector:
+        matchLabels:
+          app.kubernetes.io/name: traefik
+    ports:
+    - {protocol: TCP, port: 8089}
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata: