diff --git a/charts/supabase/templates/networkpolicies/auth-networkpolicy.yaml b/charts/supabase/templates/networkpolicies/auth-networkpolicy.yaml
new file mode 100644
index 00000000..8c09554e
--- /dev/null
+++ b/charts/supabase/templates/networkpolicies/auth-networkpolicy.yaml
@@ -0,0 +1,48 @@
+{{- if and (.Values.networkPolicies.enabled | default false) .Values.deployment.auth.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "supabase.auth.fullname" . }}-netpol
+  labels:
+    {{- include "supabase.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "supabase.auth.selectorLabels" . | nindent 6 }}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+      - podSelector:
+          matchLabels:
+            {{- include "supabase.kong.selectorLabels" . | nindent 12 }}
+      ports:
+      - protocol: TCP
+        port: {{ .Values.service.auth.port | default 9999 }}
+  egress:
+    - to:
+      - namespaceSelector:
+          matchLabels:
+            kubernetes.io/metadata.name: kube-system
+      ports:
+      - protocol: UDP
+        port: 53
+    - to:
+      - namespaceSelector: {}
+      ports:
+      - protocol: TCP
+        port: 5432
+    - to:
+      - namespaceSelector: {}
+      ports:
+      - protocol: TCP
+        port: 587
+      - protocol: TCP
+        port: 465
+    - to:
+      - namespaceSelector: {}
+      ports:
+      - protocol: TCP
+        port: 443
+{{- end }}
diff --git a/charts/supabase/templates/networkpolicies/kong-networkpolicy.yaml b/charts/supabase/templates/networkpolicies/kong-networkpolicy.yaml
new file mode 100644
index 00000000..95817de0
--- /dev/null
+++ b/charts/supabase/templates/networkpolicies/kong-networkpolicy.yaml
@@ -0,0 +1,83 @@
+{{- if and (.Values.networkPolicies.enabled | default false) .Values.deployment.kong.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "supabase.kong.fullname" . }}-netpol
+  labels:
+    {{- include "supabase.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "supabase.kong.selectorLabels" . | nindent 6 }}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+      - namespaceSelector: {}
+      ports:
+      - protocol: TCP
+        port: 8000
+  egress:
+    - to:
+      - namespaceSelector:
+          matchLabels:
+            kubernetes.io/metadata.name: kube-system
+      ports:
+      - protocol: UDP
+        port: 53
+    {{- if .Values.deployment.auth.enabled }}
+    - to:
+      - podSelector:
+          matchLabels:
+            {{- include "supabase.auth.selectorLabels" . | nindent 12 }}
+      ports:
+      - protocol: TCP
+        port: {{ .Values.service.auth.port }}
+    {{- end }}
+    {{- if .Values.deployment.rest.enabled }}
+    - to:
+      - podSelector:
+          matchLabels:
+            {{- include "supabase.rest.selectorLabels" . | nindent 12 }}
+      ports:
+      - protocol: TCP
+        port: {{ .Values.service.rest.port }}
+    {{- end }}
+    {{- if .Values.deployment.realtime.enabled }}
+    - to:
+      - podSelector:
+          matchLabels:
+            {{- include "supabase.realtime.selectorLabels" . | nindent 12 }}
+      ports:
+      - protocol: TCP
+        port: {{ .Values.service.realtime.port }}
+    {{- end }}
+    {{- if .Values.deployment.storage.enabled }}
+    - to:
+      - podSelector:
+          matchLabels:
+            {{- include "supabase.storage.selectorLabels" . | nindent 12 }}
+      ports:
+      - protocol: TCP
+        port: {{ .Values.service.storage.port }}
+    {{- end }}
+    {{- if .Values.deployment.studio.enabled }}
+    - to:
+      - podSelector:
+          matchLabels:
+            {{- include "supabase.studio.selectorLabels" . | nindent 12 }}
+      ports:
+      - protocol: TCP
+        port: {{ .Values.service.studio.port }}
+    {{- end }}
+    {{- if .Values.deployment.meta.enabled }}
+    - to:
+      - podSelector:
+          matchLabels:
+            {{- include "supabase.meta.selectorLabels" . | nindent 12 }}
+      ports:
+      - protocol: TCP
+        port: {{ .Values.service.meta.port }}
+    {{- end }}
+{{- end }}
diff --git a/charts/supabase/templates/networkpolicies/rest-networkpolicy.yaml b/charts/supabase/templates/networkpolicies/rest-networkpolicy.yaml
new file mode 100644
index 00000000..00e0e6a9
--- /dev/null
+++ b/charts/supabase/templates/networkpolicies/rest-networkpolicy.yaml
@@ -0,0 +1,36 @@
+{{- if and (.Values.networkPolicies.enabled | default false) .Values.deployment.rest.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "supabase.rest.fullname" . }}-netpol
+  labels:
+    {{- include "supabase.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "supabase.rest.selectorLabels" . | nindent 6 }}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+      - podSelector:
+          matchLabels:
+            {{- include "supabase.kong.selectorLabels" . | nindent 12 }}
+      ports:
+      - protocol: TCP
+        port: {{ .Values.service.rest.port | default 3000 }}
+  egress:
+    - to:
+      - namespaceSelector:
+          matchLabels:
+            kubernetes.io/metadata.name: kube-system
+      ports:
+      - protocol: UDP
+        port: 53
+    - to:
+      - namespaceSelector: {}
+      ports:
+      - protocol: TCP
+        port: 5432
+{{- end }}
diff --git a/charts/supabase/values.yaml b/charts/supabase/values.yaml
index 06595e63..cd3aa279 100644
--- a/charts/supabase/values.yaml
+++ b/charts/supabase/values.yaml
@@ -1050,6 +1050,11 @@ migration:
   #   -- Set table owner
   #   alter table app.items owner to :pguser;
 
+## Network Policies
+## When enabled, restricts pod-to-pod communication for defense-in-depth security
+networkPolicies:
+  enabled: false
+
 bigQuery:
   enabled: false
   projectId: google-project-id