diff --git a/k8s/bases/infrastructure/controllers/oauth2-proxy/reference-grant.yaml b/k8s/bases/infrastructure/controllers/oauth2-proxy/reference-grant.yaml
index eae1a0537..49a096dcf 100644
--- a/k8s/bases/infrastructure/controllers/oauth2-proxy/reference-grant.yaml
+++ b/k8s/bases/infrastructure/controllers/oauth2-proxy/reference-grant.yaml
@@ -21,6 +21,12 @@ spec:
     - group: gateway.networking.k8s.io
       kind: HTTPRoute
       namespace: opencost
+    # The Policy Reporter UI HTTPRoute (policy-reporter) backends to the
+    # oauth2-proxy Service for SSO. Prod-only (the app ships only via the hetzner
+    # overlay); inert on local/CI where the policy-reporter namespace has no HTTPRoute.
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: policy-reporter
     # Hetzner-only: the Longhorn UI HTTPRoute (longhorn-system) backends to the
     # oauth2-proxy Service for SSO. Inert on local/CI where longhorn-system has
     # no HTTPRoute.