diff --git a/charts/immich/README.md b/charts/immich/README.md
index eaaa795f4..f00fd95f5 100644
--- a/charts/immich/README.md
+++ b/charts/immich/README.md
@@ -91,6 +91,20 @@ ingress:
           pathType: Prefix
 ```
 
+## NetworkPolicy
+
+```yaml
+networkPolicy:
+  enabled: true
+  extraEgress:
+    - to:
+        - ipBlock:
+            cidr: 10.0.0.0/8
+      ports:
+        - protocol: TCP
+          port: 443
+```
+
 ## Documentation
 
 - [Design](DESIGN.md)
@@ -108,10 +122,10 @@ helm unittest --with-subchart=false charts/immich
 helm template immich charts/immich -f charts/immich/ci/ci-values.yaml
 ```
 
-### 🟢 Security Scan: `immich`
+### Security Scan: `immich`
 
 | Framework | Score |
 |---|---|
 | MITRE + NSA + SOC2 | **88.61111%** |
 
-> ✅ Security posture acceptable.
+Security posture acceptable.
diff --git a/charts/immich/templates/NOTES.txt b/charts/immich/templates/NOTES.txt
index effc3c60f..aeeb8177c 100644
--- a/charts/immich/templates/NOTES.txt
+++ b/charts/immich/templates/NOTES.txt
@@ -1,28 +1,24 @@
 {{/* SPDX-License-Identifier: Apache-2.0 */}}
-=============================================================================
-Immich deployed successfully!
-=============================================================================
+1. Summary
+   Immich has been deployed successfully.
+   Image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
+   Service: {{ include "immich.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }}
 
-ACCESS:
+2. Access
 {{- if .Values.ingress.enabled }}
   {{- range .Values.ingress.hosts }}
-   http{{ if $.Values.ingress.tls }}s{{ end }}://{{ .host }}
+   URL: http{{ if $.Values.ingress.tls }}s{{ end }}://{{ .host }}
   {{- end }}
 {{- else if and .Values.gateway.enabled .Values.gateway.hostnames }}
   {{- range .Values.gateway.hostnames }}
-   https://{{ . }}
+   URL: https://{{ . }}
   {{- end }}
 {{- else }}
    kubectl port-forward svc/{{ include "immich.fullname" . }} -n {{ .Release.Namespace }} 2283:{{ .Values.service.port }}
    Open: http://localhost:2283
 {{- end }}
 
-SERVICE:
-   Internal: {{ include "immich.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }}
-   Health:   {{ .Values.probes.path }}
-   Image:    {{ .Values.image.repository }}:{{ .Values.image.tag }}
-
-DATABASE:
+3. Data Services
 {{- if .Values.postgresql.enabled }}
    PostgreSQL: bundled HelmForge subchart with Immich VectorChord image
    Service: {{ .Release.Name }}-postgresql.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.postgresql.service.port | default 5432 }}
@@ -30,8 +26,6 @@ DATABASE:
    PostgreSQL: external
    Host: {{ .Values.database.external.host }}:{{ .Values.database.external.port }}
 {{- end }}
-
-CACHE:
 {{- if .Values.valkey.internal.enabled }}
    Redis-compatible cache: bundled HelmForge Redis subchart aliased as valkey
    Service: {{ include "immich.valkeyHost" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.valkey.service.ports.redis | default 6379 }}
@@ -41,24 +35,26 @@ CACHE:
 {{- end }}
 
 {{- if .Values.machineLearning.enabled }}
-MACHINE LEARNING:
+4. Machine Learning
    Service: {{ include "immich.fullname" . }}-machine-learning.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.machineLearning.service.port }}
 {{- end }}
 
-OPERATIONS:
+5. Validation
+   Health path: {{ .Values.probes.path }}
    Run Helm tests:
-     helm test {{ .Release.Name }} -n {{ .Release.Namespace }}
+   helm test {{ .Release.Name }} -n {{ .Release.Namespace }}
 
+6. Troubleshooting
    Inspect pods:
-     kubectl get pods -n {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }}
-     kubectl logs -n {{ .Release.Namespace }} deploy/{{ include "immich.fullname" . }}
+   kubectl get pods -n {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }}
+   kubectl logs -n {{ .Release.Namespace }} deploy/{{ include "immich.fullname" . }}
 
-PRODUCTION REMINDERS:
+7. Production Reminders
    1. Use explicit Secrets or External Secrets for PostgreSQL and cache credentials.
    2. Keep upload persistence on durable storage and use ReadWriteMany before scaling server replicas.
    3. Configure HTTPS through Ingress or Gateway API before exposing Immich publicly.
 
-DOCUMENTATION:
+8. Resources
    Chart: https://helmforge.dev/docs/charts/immich
    Source: https://github.com/helmforgedev/charts/tree/main/charts/immich
    Immich: https://immich.app
diff --git a/charts/immich/templates/networkpolicy.yaml b/charts/immich/templates/networkpolicy.yaml
index 7b641010e..8384ba041 100644
--- a/charts/immich/templates/networkpolicy.yaml
+++ b/charts/immich/templates/networkpolicy.yaml
@@ -21,8 +21,9 @@ spec:
         - namespaceSelector: {}
     {{- end }}
   egress:
-    {{- if .Values.networkPolicy.egress }}
-    {{- toYaml .Values.networkPolicy.egress | nindent 4 }}
+    {{- $egress := .Values.networkPolicy.egress | default (list (dict)) }}
+    {{- with concat $egress (.Values.networkPolicy.extraEgress | default list) }}
+    {{- toYaml . | nindent 4 }}
     {{- else }}
     - {}
     {{- end }}
diff --git a/charts/immich/tests/networkpolicy-extra-egress-values.yaml b/charts/immich/tests/networkpolicy-extra-egress-values.yaml
new file mode 100644
index 000000000..1c14847cc
--- /dev/null
+++ b/charts/immich/tests/networkpolicy-extra-egress-values.yaml
@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: Apache-2.0
+networkPolicy:
+  enabled: true
+  extraEgress:
+    - to:
+        - ipBlock:
+            cidr: 10.0.0.0/8
+      ports:
+        - protocol: TCP
+          port: 443
diff --git a/charts/immich/tests/networkpolicy_test.yaml b/charts/immich/tests/networkpolicy_test.yaml
new file mode 100644
index 000000000..0e16eb579
--- /dev/null
+++ b/charts/immich/tests/networkpolicy_test.yaml
@@ -0,0 +1,52 @@
+# SPDX-License-Identifier: Apache-2.0
+suite: NetworkPolicy
+templates:
+  - templates/networkpolicy.yaml
+release:
+  name: test
+tests:
+  - it: should render default ingress and egress when enabled
+    set:
+      networkPolicy.enabled: true
+    asserts:
+      - isKind:
+          of: NetworkPolicy
+      - equal:
+          path: spec.policyTypes[0]
+          value: Ingress
+      - equal:
+          path: spec.policyTypes[1]
+          value: Egress
+      - equal:
+          path: spec.ingress[0].from[0].namespaceSelector
+          value: {}
+      - equal:
+          path: spec.egress[0]
+          value: {}
+
+  - it: should append extra egress rules
+    values:
+      - networkpolicy-extra-egress-values.yaml
+    asserts:
+      - equal:
+          path: spec.egress[0]
+          value: {}
+      - equal:
+          path: spec.egress[1].to[0].ipBlock.cidr
+          value: 10.0.0.0/8
+      - equal:
+          path: spec.egress[1].ports[0].port
+          value: 443
+
+  - it: should append extraEgress after base egress rules
+    set:
+      networkPolicy.enabled: true
+      networkPolicy.egress[0].to[0].ipBlock.cidr: 172.16.0.0/12
+      networkPolicy.extraEgress[0].to[0].ipBlock.cidr: 10.0.0.0/8
+    asserts:
+      - equal:
+          path: spec.egress[0].to[0].ipBlock.cidr
+          value: 172.16.0.0/12
+      - equal:
+          path: spec.egress[1].to[0].ipBlock.cidr
+          value: 10.0.0.0/8
diff --git a/charts/immich/tests/test_connection_test.yaml b/charts/immich/tests/test_connection_test.yaml
new file mode 100644
index 000000000..118d2acb3
--- /dev/null
+++ b/charts/immich/tests/test_connection_test.yaml
@@ -0,0 +1,18 @@
+# SPDX-License-Identifier: Apache-2.0
+suite: Helm Test
+templates:
+  - templates/tests/test-connection.yaml
+release:
+  name: test
+  namespace: default
+tests:
+  - it: should render the Helm test hook pod
+    asserts:
+      - isKind:
+          of: Pod
+      - equal:
+          path: metadata.name
+          value: test-immich-test
+      - equal:
+          path: metadata.annotations["helm.sh/hook"]
+          value: test
diff --git a/charts/immich/values.schema.json b/charts/immich/values.schema.json
index 54968cce9..a5338bb87 100644
--- a/charts/immich/values.schema.json
+++ b/charts/immich/values.schema.json
@@ -140,7 +140,16 @@
         "pathType": { "type": "string", "enum": ["Exact", "PathPrefix", "RegularExpression"] }
       }
     },
-    "networkPolicy": { "type": "object" },
+    "networkPolicy": {
+      "type": "object",
+      "additionalProperties": true,
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "ingress": { "type": "array" },
+        "egress": { "type": "array" },
+        "extraEgress": { "type": "array" }
+      }
+    },
     "autoscaling": { "type": "object" },
     "pdb": { "type": "object" },
     "probes": { "type": "object" },
diff --git a/charts/immich/values.yaml b/charts/immich/values.yaml
index 83ba16f2b..04a9e1cb1 100644
--- a/charts/immich/values.yaml
+++ b/charts/immich/values.yaml
@@ -346,6 +346,8 @@ networkPolicy:
   ingress: []
   # -- Additional egress rules. Defaults allow all egress for database, cache, machine-learning, and external API compatibility.
   egress: []
+  # -- Additional egress rules appended after networkPolicy.egress.
+  extraEgress: []
 
 autoscaling:
   # -- Enable HorizontalPodAutoscaler for the Immich server.