diff --git a/charts/apache/docs/networking.md b/charts/apache/docs/networking.md
index 04677bea6..1b6e419d0 100644
--- a/charts/apache/docs/networking.md
+++ b/charts/apache/docs/networking.md
@@ -50,6 +50,14 @@ networkPolicy:
     enabled: true
     allowDns: true
     allowInternet: false
+    extraEgress:
+      - to:
+          - ipBlock:
+              cidr: 10.0.0.0/8
+        ports:
+          - protocol: TCP
+            port: 443
 ```
 
 When `allowInternet=true`, the chart allows both `0.0.0.0/0` and `::/0` so IPv4, IPv6, and dual-stack clusters behave consistently.
+Use `extraEgress` for complete additional egress rules with `to` and `ports`.
diff --git a/charts/apache/templates/NOTES.txt b/charts/apache/templates/NOTES.txt
index 4d3f18009..5a7d2ef4f 100644
--- a/charts/apache/templates/NOTES.txt
+++ b/charts/apache/templates/NOTES.txt
@@ -4,8 +4,8 @@
 Apache HTTP Server has been installed
 =====================================
 
-Installation summary
---------------------
+1. Installation summary
+=======================
 Release: {{ .Release.Name }}
 Namespace: {{ .Release.Namespace }}
 Chart version: {{ .Chart.Version }}
@@ -17,8 +17,8 @@ Service type: {{ .Values.service.type }}
 Service port: {{ .Values.service.port }}
 Container port: {{ .Values.containerPorts.http }}
 
-Access Apache
--------------
+2. Access
+=========
 Port-forward the Service:
 
   kubectl port-forward svc/{{ include "apache.fullname" . }} -n {{ .Release.Namespace }} 8080:{{ .Values.service.port }}
@@ -32,8 +32,8 @@ Cluster-local endpoints:
   http://{{ include "apache.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }}/
   http://{{ include "apache.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }}/healthz
 
-Content source
---------------
+3. Content
+==========
 {{- if .Values.content.existingConfigMap }}
 The web root is mounted from this existing ConfigMap:
 
@@ -50,8 +50,8 @@ Rendered content file count:
   {{ len .Values.content.files }}
 {{- end }}
 
-Security summary
-----------------
+4. Credentials and security
+===========================
 Non-root runtime: enabled
 Read-only root filesystem: {{ .Values.securityContext.readOnlyRootFilesystem }}
 Run as user: {{ .Values.securityContext.runAsUser }}
@@ -65,8 +65,8 @@ Basic Auth Secret:
   {{ include "apache.basicAuthSecretName" . }}
 {{- end }}
 
-Routing summary
----------------
+5. Configuration summary
+========================
 Ingress: {{ ternary "enabled" "disabled" .Values.ingress.enabled }}
 Gateway API HTTPRoute: {{ ternary "enabled" "disabled" .Values.gateway.enabled }}
 NetworkPolicy: {{ ternary "enabled" "disabled" .Values.networkPolicy.enabled }}
@@ -88,8 +88,8 @@ Gateway hostnames:
 {{- end }}
 {{- end }}
 
-Observability summary
----------------------
+6. Observability
+================
 Metrics sidecar: {{ ternary "enabled" "disabled" .Values.metrics.enabled }}
 ServiceMonitor: {{ ternary "enabled" "disabled" .Values.metrics.serviceMonitor.enabled }}
 {{- if .Values.metrics.enabled }}
@@ -102,8 +102,8 @@ Apache server-status path:
   {{ .Values.serverStatus.path }}
 {{- end }}
 
-Validate the deployment
------------------------
+7. Validation commands
+======================
 Run the Helm test:
 
   helm test {{ .Release.Name }} -n {{ .Release.Namespace }}
@@ -122,8 +122,8 @@ Probe the health endpoint through a temporary curl pod:
   kubectl run {{ .Release.Name }}-curl -n {{ .Release.Namespace }} --rm -i --restart=Never --image=curlimages/curl:8.17.0 -- \
     curl -fsS http://{{ include "apache.fullname" . }}:{{ .Values.service.port }}/healthz
 
-Troubleshooting
----------------
+8. Troubleshooting
+==================
 Inspect Apache logs:
 
   kubectl logs -n {{ .Release.Namespace }} deploy/{{ include "apache.fullname" . }} -c apache --since=10m
@@ -151,8 +151,8 @@ Common checks:
   4. If Gateway routing fails, check parentRefs, listener hostnames, and GatewayClass readiness.
   5. If NetworkPolicy is enabled, confirm your CNI enforces policies and selectors match the caller.
 
-Documentation
--------------
+9. Resources
+============
 Chart docs:
 
   https://helmforge.dev/docs/charts/apache
diff --git a/charts/apache/templates/networkpolicy.yaml b/charts/apache/templates/networkpolicy.yaml
index 391753eb7..839658bfb 100644
--- a/charts/apache/templates/networkpolicy.yaml
+++ b/charts/apache/templates/networkpolicy.yaml
@@ -62,5 +62,8 @@ spec:
     {{- with .Values.networkPolicy.egress.extraRules }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with .Values.networkPolicy.egress.extraEgress }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
   {{- end }}
 {{- end }}
diff --git a/charts/apache/templates/tests/test-connection.yaml b/charts/apache/templates/test-connection.yaml
similarity index 100%
rename from charts/apache/templates/tests/test-connection.yaml
rename to charts/apache/templates/test-connection.yaml
diff --git a/charts/apache/tests/networkpolicy_test.yaml b/charts/apache/tests/networkpolicy_test.yaml
index 34e504aae..82a2c3211 100644
--- a/charts/apache/tests/networkpolicy_test.yaml
+++ b/charts/apache/tests/networkpolicy_test.yaml
@@ -53,3 +53,27 @@ tests:
           path: spec.ingress
       - exists:
           path: spec.egress
+
+  - it: should render canonical extra egress rules
+    set:
+      networkPolicy.enabled: true
+      networkPolicy.egress.enabled: true
+      networkPolicy.egress.allowDns: false
+      networkPolicy.egress.allowInternet: false
+      networkPolicy.egress.extraEgress:
+        - to:
+            - ipBlock:
+                cidr: 10.0.0.0/8
+          ports:
+            - protocol: TCP
+              port: 443
+    asserts:
+      - contains:
+          path: spec.egress
+          content:
+            to:
+              - ipBlock:
+                  cidr: 10.0.0.0/8
+            ports:
+              - protocol: TCP
+                port: 443
diff --git a/charts/apache/tests/test_connection_test.yaml b/charts/apache/tests/test_connection_test.yaml
new file mode 100644
index 000000000..4421a424b
--- /dev/null
+++ b/charts/apache/tests/test_connection_test.yaml
@@ -0,0 +1,21 @@
+# SPDX-License-Identifier: Apache-2.0
+suite: Helm Test
+templates:
+  - test-connection.yaml
+release:
+  name: test
+  namespace: default
+tests:
+  - it: should render helm test pod
+    asserts:
+      - isKind:
+          of: Pod
+      - equal:
+          path: metadata.name
+          value: test-apache-test-connection
+      - equal:
+          path: metadata.annotations["helm.sh/hook"]
+          value: test
+      - matchRegex:
+          path: spec.containers[0].command[2]
+          pattern: "/healthz"
diff --git a/charts/apache/values.yaml b/charts/apache/values.yaml
index ffcdf930b..4f95996bd 100644
--- a/charts/apache/values.yaml
+++ b/charts/apache/values.yaml
@@ -152,8 +152,10 @@ networkPolicy:
     allowDns: true
     # -- Allow general IPv4 and IPv6 internet egress.
     allowInternet: true
-    # -- Extra egress rules.
+    # -- Extra egress rules kept for backward compatibility.
     extraRules: []
+    # -- Extra egress rules using the canonical HelmForge value.
+    extraEgress: []
 
 serviceAccount:
   # -- Create a dedicated ServiceAccount.